Polymorphic virus detection module

• US 5,826,013 A
• Filed: 01/08/1997
• Issued: 10/20/1998
• Est. Priority Date: 09/28/1995
• Status: Expired due to Term

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Nachenberg, Carey S.
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): HUA, LY
• Application Number:
  US08/780,985
• Time in Patent Office: 650 Days
• Field of Search: 395/186, 395/183.14, 395/183.09, 395/183.01, 380/4, 380/25
• US Class Current: 726/22
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A Polymorphic Anti-virus Module (PAM) (200) comprises a CPU emulator (210) for emulating the target program, a virus signature scanning module (250) for scanning decrypted virus code, and an emulation control module (220), including a static exclusion module (230), a dynamic exclusion module (240), instruction/interrupt usage profiles (224) for the mutation engines (162) of the known polymorphic viruses (150), size and target file types (226) for these viruses, and a table (228) having an entry for each known polymorphic virus (150). During emulation, the emulation control module (220) may observe use of a register-indirect memory write instruction using a register that has not been initialized. Such a random write can be used as an indication that the file is probably a data file and so is unlikely to harbor a virus.

Claims

1. A computer-implemented method for detecting computer viruses in a computer file, the method comprising:

determining whether an instruction is a register-indirect memory write, which writes to a memory address specified by the contents of a register;

determining whether the register is uninitialized if the instruction is a register-indirect memory write; and

excluding from consideration those viruses that cannot perform register-indirect memory writes if the register is uninitialized.

2. The computer-implemented method of claim 1, further comprising:

setting a flag if the register is initialized.

3. The computer-implemented method of claim 2, wherein determining whether the register is uninitialized comprises determining whether the flag is set.

4. The computer-implemented method of claim 1, wherein the register is an index register.

5. The computer-implemented method of claim 1, wherein the register is a base register.

6. A system for detecting computer viruses in a computer file, the system comprising:

a register;

an emulation control module for determining whether an instruction is a register indirect memory write, which writes to a memory address specified by the contents of a register;

determining whether the register is uninitialized if the instruction is a register-indirect memory write; and

excluding from consideration those viruses that cannot perform register-indirect memory writes if the register is uninitialized; and

a CPU emulator for simulating instructions of the computer file.

7. A computer program product comprising a computer-usable medium having a computer-readable code embodied therein for detecting computer viruses in a computer file, comprising:

computer-readable program code devices configures to determine whether an instruction is a register-indirect memory write, which writes to a memory address specified by the contents of a register;

computer-readable program code devices configured to determine whether the register is uninitialized if the instruction is a register-indirect memory write; and

computer-readable program code devices configured to exclude from consideration those viruses that cannot perform register-indirect memory writes if the register is uninitialized.