Self-Healing Spyware: Detection, and Remediation

Spyware has become a significant threat to most Internet users as it introduces serious privacy disclosure, and potential security breach to the systems. It has not only utilized critical areas of the computer system to survive reboots, but also grown resilient against current anti-spyware tools; they are capable of self-healing themselves against deletion. Because existing anti-spyware tools are stateless in the sense that they do not remember or monitor the spyware programs that were deleted, they fail to remove self-healing spyware from the system completely. This paper proposes a stateful approach that is based on characterizing spyware invasion as a trust information flow problem, and implements STARS (Stateful Threat-Aware Removal System), which is a tool that at run time monitors critical system behaviors.