Backwards researching existing pestware

• US 20070250818A1
• Filed: 04/20/2006
• Published: 10/25/2007
• Est. Priority Date: 04/20/2006
• Status: Abandoned Application

• Current Assignee: Webroot Software Incorporated (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Boney, Matthew
• Application Number:
  US11/408,215
• Publication Number:
  US 20070250818A1
• Time in Patent Office: Days
• US Class Current: 717/124
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system and method for researching a source of pestware on a computer is described. In one embodiment, the method includes identifying pestware on the computer, accessing recorded information on the computer relating to a history of the pestware and traversing at least a subset of the recorded information, wherein the traversing includes accessing data within the recorded information that provides a reference to an identity of a source of the pestware.

Claims

1. A method for identifying an origin of pestware residing on a computer comprising:

identifying pestware on the computer;

accessing recorded information on the computer relating to a history of the pestware; and

traversing at least a subset of the recorded information, wherein the traversing includes accessing data within the recorded information that provides a reference to an identity of a source of the pestware.

2. The method of claim 1, including:

reporting the source of the pestware to a pestware research entity so as to enable the pestware research entity to place the identity of the source of the pestware in a repository that includes identities of other sources of pestware.

3. The method of claim 1, wherein the identifying includes scanning processes and files of the computer.

4. The method of claim 1, wherein the identifying includes identifying a pestware process;

wherein the traversing includes;

accessing recorded information that associates the pestware file with the source of the pestware so as to identify the source of the pestware.

5. The method of claim 1, including:

monitoring a pestware process on the computer;

recording in an activity log, an attempt by the pestware process to launch another process from a stored file;

wherein the traversing includes identifying a reference to the stored file in the recorded information and identifying a reference to an identity of the source of the file using the reference to the stored file.

6. The method of claim 5, wherein the monitoring includes monitoring the process with a kernel-mode driver.

7. The method of claim 1, wherein the source is identified by an identifier selected from the group consisting of an I.P. address, a URL, an email client and a program name.

8. The method of claim 1, wherein the accessing includes accessing the recorded information from a file stored on the computer that is selected from the group consisting of an activity log, a browser history, browser cache, browser settings, operating system settings, an event log, a debugging log, a firewall log, file information and monitoring software logs.

9. A system for identifying a source of pestware on a computer including:

a detection portion configured to detect pestware on the computer; and

a research portion configured to access recorded information on the computer relating to a history of the pestware and to access data within the recorded information that provides a reference to an identity of a source of the pestware;

a reporting portion configured to report the source of the pestware to a pestware research entity.

10. The system of claim 9, wherein the detection portion includes a drive scan portion configured to detect pestware on a file storage device of the computer, a memory scan portion configured to detect pestware residing in an executable memory of the computer and a registry scan portion configured to scan a registry of an operating system of the computer for indicia of pestware.

11. The system of claim 10, including:

an activity monitor configured to monitor API calls and to store a history of at least a portion of the API calls in an activity log.

12. The system of claim 11, wherein the activity monitor is configured to store a history of API calls to create processes along with information about files associated with the processes in the activity log, and wherein the research portion is configured to access the activity log in order to identify a file associated with a pestware process that was identified as pestware by the scanning portion as pestware.

13. The system of claim 11, wherein the activity monitor includes a kernel-mode driver adapted to intercept the API calls.

14. The system of claim 9, wherein the source is identified by an identifier selected from the group consisting of an I.P. address, a URL, an email client and a program name.

15. The system of claim 9, wherein the recorded information is recorded in a file selected from the group consisting of an activity log, a browser history, browser cache, browser settings, operating system settings, an event log, a debugging log, a firewall log, file information and monitoring software logs.

16. A computer-readable medium encoded with processor-executable instructions for identifying an origin of pestware residing on a computer, the instructions including instructions for:

identifying pestware on the computer;

accessing recorded information on the computer relating to a history of the pestware; and

traversing at least a subset of the recorded information, wherein the traversing includes accessing data within the recorded information that provides a reference to an identity of a source of the pestware.

17. The computer-readable medium of claim 16, including instructions for:

reporting the source of the pestware to a pestware research entity so as to enable the pestware research entity to place the identity of the source of the pestware in a repository that includes identities of other sources of pestware.

18. The computer-readable medium of claim 16, wherein the instructions for identifying includes instructions for scanning processes and files of the computer.

19. The computer-readable medium of claim 16, wherein the instructions for identifying includes instructions for identifying a pestware process and wherein the instructions for traversing include instructions for:

accessing recorded information that associates the pestware process with a pestware file so as to identify the pestware file; and

accessing recorded information that associates the pestware file with the source of the pestware so as to identify the source of the pestware.

20. The computer-readable medium of claim 16, including instructions for:

monitoring a pestware process on the computer;

recording in an activity log, an attempt by the pestware process to launch another process from a stored file;

wherein the instructions for traversing include instructions for identifying a reference to the stored file in the recorded information and identifying a reference to an identity of the source of the file using the reference to the stored file.

21. The computer-readable medium of claim 20, wherein the instructions for monitoring include instructions for monitoring the process with a kernel-mode driver.

22. The computer-readable medium of claim 16, wherein the source is identified by an identifier selected from the group consisting of an I.P. address, a URL, an email client and a program name.

23. The computer-readable medium of claim 16, wherein the instructions for accessing include instructions for accessing the recorded information from a file stored on the computer that is selected from the group consisting of:

an activity log, a browser history, browser cache, browser settings, operating system settings, an event log, a debugging log, a firewall log, file information and monitoring software logs.