Selective detection of malicious computer code

• US 20040068664A1
• Filed: 10/07/2002
• Published: 04/08/2004
• Est. Priority Date: 10/07/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Nachenberg, Carey, Szor, Peter
• Granted Patent: US 7,337,471 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

System, methods, and computer readable media for determining whether a computer file (340) has been infected by an attacking agent. A scanning engine (205) generates a new hash of a critical viral target region of the file (340) and compares it to a stored hash of the critical viral target region. The scanning engine (205) determines whether the file (340) has been scanned by the most recent version of a detection module (425) associated with the attacking agent. If the hashes are identical and the file (340) has been scanned by the most recent version of the detection module (425), the scanning engine (205) determines that the file (340) is free of infection by the attacking agent.

Claims

1. A method for detecting infection of a computer file by an attacking agent, the method comprising the steps of:

generating a new hash of a critical viral target region of the file;

comparing the new hash of the critical viral target region to a previously generated hash of the critical viral target region;

determining whether the file has been scanned for infection by the attacking agent with a most recent version of a detection module; and

determining that the file has not been infected by the attacking agent when the new hash and the previously generated hash are identical, and the file has been scanned with the most recent version of the detection module.

2. The method of claim 1, further comprising the step of applying the detection module to the file in response to a determination that the file has not been scanned by the most recent version of the detection module.

3. The method of claim 2, further comprising the step of updating an indicator of a most recent version of a scanning engine applied to the file to indicate a current version of the scanning engine.

4. The method of claim 1, wherein the step of determining whether the file has been scanned for infection by the attacking agent with a most recent version of the detection module comprises the sub-steps of:

determining a most recent version of a scanning engine applied to the file;

determining a most recent version of the scanning engine to include an updated version of the detection module; and

determining that the file has been scanned with the most recent version of the detection module when the most recent version of the scanning engine applied to the file was not created earlier than the most recent version of the scanning engine to include an updated version of the detection module.

5. The method of claim 1, further comprising the step of applying the detection module to the file in response to a determination that the new hash and the previously generated hash are not identical.

6. The method of claim 5, further comprising the step of replacing the previously generated hash of the critical viral target region with the new hash of the critical viral target region.

7. The method of claim 1, wherein the critical viral target region includes an executable file header.

8. The method of claim 1, wherein the critical viral target region includes a start of a relocation section.

9. The method of claim 1, wherein the critical viral target region includes a region around a program entry point.

10. A system for detecting infection of a computer file by an attacking agent, the system comprising:

a detection module configured to check the computer file for infection by the attacking agent, the detection module including an identifier of a most recent version of a scanning engine to include an update to the detection module;

a database, in communication with the detection module, and storing entries, each entry associated with a file and containing a previously generated hash of a critical viral target region and an identifier indicating a most recent version of the scanning engine to scan the file for the presence of malicious code;

a hash generator, in communication with the database, and configured to generate a new hash of the critical viral target region;

a selection module, in communication with the database and the hash generator, and configured to;

compare the new hash of the critical viral target region to the previously generated hash of the critical viral target region;

compare the identifier of the most recent version of the scanning engine to scan the file to the identifier of the most recent version of the scanning engine to include an update of the detection module; and

determine that the file has not been infected by an attacking agent when the new hash and the previously generated hash are identical, and the most recent version of the scanning engine to scan the file is not an earlier version than the most recent version of the scanning engine to include an update of the detection module.

11. The system of claim 10, wherein the selection module is further configured to:

apply the detection module to the file in response to a determination that the most recent version of the scanning engine to scan the file is an earlier version than the most recent version of the scanning engine to include an update of the detection module.

12. The system of claim 11, further comprising an update module, in communication with the database and with the selection module, and configured to update the identifier of the most recent version of the scanning engine to scan the file to indicate that the most recent version of the scanning engine to scan the file is the current version of the scanning engine.

13. The system of claim 10, wherein the selection module is further configured to apply a detection module to the file in response to a determination that the new hash and the previously generated hash are not identical.

14. The system of claim 13, wherein the update module is further configured to update the database to store the new hash of the critical viral target region.

15. A computer-readable medium containing computer code instructions for detecting infection of a file by an attacking agent, the computer code comprising instructions for:

generating a new hash of a critical viral target region of the file;

comparing the new hash of the critical viral target region to a previously generated hash of the critical viral target region;

determining whether the file has been scanned for infection by the attacking agent with a most recent version of a detection module; and

determining that the file has not been infected by the attacking agent when the new hash and the previously generated hash are identical, and the file has been scanned with the most recent version of the detection module.

16. The computer readable medium of claim 15, wherein the instructions for detecting infection of a file by an attacking agent further comprise instructions for applying the detection module to the file in response to a determination that the file has not been scanned by the most recent version of the detection module.

17. The computer readable medium of claim 16, wherein the instructions for detecting infection of a file by an attacking agent further comprise instructions for updating an indicator of a most recent version of a scanning engine applied to the file to indicate a current version of the scanning engine.

18. The computer readable medium of claim 15, wherein the instructions for detecting infection of a file by an attacking agent further comprise instructions for applying the detection module to the file in response to a determination that the new hash and the previously generated hash are not identical.

19. The computer readable medium of claim 18, wherein the instructions for detecting infection of a file by an attacking agent further comprise instructions for replacing the previously generated hash of the critical viral target region with the new hash of the critical viral target region.

20. A method for detecting infection of a file by a plurality of attacking agents, the method comprising:

comparing, for each attacking agent, a new hash of a critical viral target region to a previously generated hash of the critical viral target region;

determining, for each attacking agent, whether the file has been scanned for infection by the attacking agent with a most recent version of a detection module associated with the attacking agent;

determining, for each attacking agent, that the file has not been infected by the attacking agent when the new hash and the previously generated hash are identical, and the file has been scanned with the most recent version of the detection module;

determining that the file does not contain malicious code when the file has not been infected by any attacking agents.