7. And what if a user from an already infected device connects to the system?
Functions will be available in the second version of LevelNet. the treatment of active infection is highly dependent on malware.
At the first stage of development, the main goal that faces LevelNet is a preventive measure, that is, Do not allow the device to be infected.
Option 1:
Your system is infected with malware with a function (kernel level rootkit / self-defense module). antivirus or our solutions removed malware objects
are installed by the malware protection module after uninstallation.
Solution A: Our solution overloads the device in debug mode (before OS boot) and deletes objects.
Solution B: Our solution proposes to install an antivirus package of the company that can heal the device. It installs it in a silent mode then
initializes the function of treating infected objects or deleting them.
Option 2:
Your system is infected with a malicious program without a rootkit or a user-level rootkit.
Solution A: Our solution overloads the device in debug mode (before OS boot) and deletes objects.
Solution B: Similar to option 1
Option 3 *: Your system is infected with a malicious program that is executed in memory, i.e. Does not have objects on the disk and it is launched through
shell code of exploit.
Solution: suspend and kill processes, reboot the device.
* In fact, this threat is not removed by any antivirus package and they are all silent about this fact, or they kill the process in which there is
malicious code. This is due to the fact that the projected code in memory is hard to update by signature.