SYSTEM AND METHOD FOR NEUTRALIZING PESTWARE RESIDING IN EXECUTABLE MEMORY

摘要

Systems and methods for managing pestware on a protected computer are described. In one implementation, a pestware construct is identified. Functions exported by the pestware process are identified, and neutralization of the pestware process is accomplished by skipping a portion of the executed code for pestware functions exported by the pestware process. Registry entries associated with the pestware process are detected and deleted, and the pestware process is scheduled for deletion after the next reboot of a protected computer.