Systems and methods for verifying trust of executable files

• US 20060230451A1
• Filed: 04/07/2005
• Published: 10/12/2006
• Est. Priority Date: 04/07/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: England, Paul, Ray, Kenneth D., Kramer, Michael, Field, Scott A., Schwartz, Jonathan D.
• Granted Patent: US 7,490,352 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 16/17 Details of further file system functions
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

Systems and methods for validating integrity of an executable file are described. In one aspect, the systems and methods determine that an executable file is being introduced into a path of execution. The executable file is then automatically evaluated in view of multiple malware checks to detect if the executable file represents a type of malware. The multiple malware checks are integrated into an operating system trust verification process along the path of execution.

Claims

1. A computer-implemented method comprising:

determining that an executable file is being introduced into a path of execution; and

responsive to the determining, automatically evaluating the executable file with multiple malware checks to detect if the executable file represents a type of malware, the multiple malware checks being integrated into an operating system trust verification process along the path of execution.

2. A method as recited in claim 1, wherein the path of execution comprises an installation path or a path associated with loading at least a portion of the executable code into memory for execution.

3. A method as recited in claim 1, wherein the multiple malware checks are integrated into a file system module or a memory manager module of the operating system.

4. A method as recited in claim 1, wherein the multiple integrated malware checks comprise a virus check, a spy ware check, and a code-integrity check.

5. A method as recited in claim 1, wherein the executable file is being installed onto the computing device, and wherein the method further comprises:

if the executable file is not malware in view of the multiple malware checks, allowing an entity to mark the executable file as trustworthy, of questionable trustworthiness, or untrustworthy; and

only if the executable file is trustworthy, installing the executable file onto the computing device.

6. A method as recited in claim 1, wherein at least a portion of the executable file is being loaded into memory for execution, and wherein the method further comprises:

if the executable file is not malware in view of the multiple malware checks;

allowing an entity to mark the executable file as trustworthy, of questionable trustworthiness, or untrustworthy; and

only if the executable file is trustworthy, loading the at least a portion of the executable file into memory for execution.

7. A method as recited in claim 1, wherein the method further comprises responsive to determining that the executable file is being installed, automatically determining if the executable file is from by a trusted source.

8. A method as recited in claim 1, wherein the executable file was determined to be trustworthy upon installation, and wherein the method further comprises:

determining, subsequent to installation of the executable file, that the executable file comprises malware; and

revoking trustworthiness of the executable file.

9. A computer-readable medium comprising computer-program instructions executable by a processor for:

determining that an executable file is being introduced into a path of execution; and

responsive to the determining, automatically evaluating the executable file with multiple malware checks to detect if the executable file represents a type of malware, the multiple malware checks being integrated into an operating system trust verification process along the path of execution.

10. A computer-readable medium as recited in claim 9, wherein the multiple malware checks are integrated into a file system module or a memory manager module of the operating system.

11. A computer-readable medium as recited in claim 9, wherein the multiple integrated malware checks comprise a virus check, a spy ware check, and a code-integrity check.

12. A computer-readable medium as recited in claim 9, wherein the executable file is being installed onto the computing device, and wherein the computer-program instructions further comprise instructions for:

if the executable file is not malware in view of the multiple malware checks, allowing an entity to mark the executable file as trustworthy, of questionable trustworthiness, or untrustworthy; and

only if the executable file is trustworthy, installing the executable file onto the computing device.

13. A computer-readable medium as recited in claim 9, wherein at least a portion of the executable file is being loaded into memory for execution, and wherein the computer-program instructions further comprise instructions for:

if the executable file is not malware in view of the multiple malware checks;

allowing an entity to mark the executable file as trustworthy, of questionable trustworthiness, or untrustworthy; and

only if the executable file is trustworthy, loading the at least a portion of the executable file into memory for execution.

14. A computer-readable medium as recited in claim 9, wherein the executable file was determined to be trustworthy upon installation, and wherein the computer-program instructions further comprise instructions for:

determining, subsequent to installation of the executable file, that the executable file comprises malware; and

revoking trustworthiness of the executable file.

15. A computing device comprising:

a processor; and

a memory coupled to the processor, the memory comprising computer-program instructions executable by the processor for;

determining that an executable file is being introduced into a path of execution; and

responsive to the determining, automatically evaluating the executable file with multiple malware checks to detect if the executable file represents a type of malware, the multiple malware checks being integrated into an operating system trust verification process along the path of execution.

16. A computing device as recited in claim 15, wherein the path of execution comprises an installation path or a path associated with loading at least a portion of the executable code into memory for execution.

17. A computing device as recited in claim 15, wherein the multiple malware checks are integrated into a file system module or a memory manager module of the operating system.

18. A computing device as recited in claim 15, wherein the multiple integrated malware checks comprise a virus check, a spy ware check, and a code-integrity check.

19. A computing device as recited in claim 15, wherein the executable file is being installed onto the computing device, and wherein the computer-program instructions further comprise instructions for:

if the executable file is not malware in view of the multiple malware checks, allowing an entity to mark the executable file as trustworthy, of questionable trustworthiness, or untrustworthy; and

only if the executable file is trustworthy, installing the executable file onto the computing device.

20. A computing device as recited in claim 15, wherein at least a portion of the executable file is being loaded into memory for execution, and wherein the computer-program instructions further comprise instructions for:

if the executable file is not malware in view of the multiple malware checks;

allowing an entity to mark the executable file as trustworthy, of questionable trustworthiness, or untrustworthy; and

only if the executable file is trustworthy, loading the at least a portion of the executable file into memory for execution.