Abstract: Scanning of the shadow copy instead of the hard disk of a computer (using an accessing interface instead of the file system interface or an API of the operating system) enables the scanning software to access any files that might have been locked by the malware on the hard disk and avoids root kits. Files cannot be locked because a disk parser is used instead of the operating system or normal file system interface. It is possible for malware to change or reinfect files during the scanning and cleaning process. Files on the hard disk in existence at the time a manual scan is begun are scanned and backed up to the cache if changed during scanning. Dropped malware is removed by reverting the hard disk to the shadow copy once scanning and cleaning has been performed. Even if a watchdog drops a file during the scanning and cleaning process (because it detects that other malware components are being affected) these dropped files will be removed.

Abstract: A method for detecting malware in a computer that employs a production operating system during normal use is provided. The method includes activating on the computer a first operating system while the production operating system is dormant and ascertaining at least a portion of the production operating system that would be involved in booting up the computer if the production operating system had been activated instead. The method further includes scanning, while the first operating system is activated and while the production operating system is dormant, the portion of the production operating system. The method further includes neutralizing, while the first operating system is activated and while the production operating system is dormant, the malware responsive to the scanning.