Countering infections to communications modules

• US 7,155,742 B1
• Filed: 05/16/2002
• Issued: 12/26/2006
• Est. Priority Date: 05/16/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Szor, Peter
• Primary Examiner(s): Moazzami, Nasser
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US10/151,598
• Time in Patent Office: 1,685 Days
• Field of Search: None
• US Class Current: 726/25
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/563 by source code analysis

Abstract

Methods, apparati and computer readable media for countering malicious code infections that spread from a first computer to a second computer. A searching module (51) searches for a communications module (20) within the first computer (1(1)). An examining module (52) examines a function location directory (27) within the communications module (20). A locating module (53) locates a send function within the function location directory (27). A declaring module (54) declares the presence of malicious code when the function location directory (27) states that the send function is slated to start executing at a non-normal location.

Claims

1. A computer implemented method for countering malicious code infections that spread from a first computer to second computer, said method comprising the steps of:

searching for a communications module within the first computer;

examining a function location directory within the communications module;

locating a send function within the function location directory;

declaring the presence of malicious code when the function location directory states that the send function is slated to start executing at a non-normal location; and

excising malicious code detected within the send function.

2. The method of claim 1 wherein the non-normal location is within a slack region of a code section within the communications module.

3. The method of claim 1 wherein the non-normal location is within a section of the communications module other than a code section.

4. The method of claim 1 wherein the non-normal location is outside the communications module.

5. The method of claim 1 wherein the communications module is a dynamic link library.

6. The method of claim 1 wherein the function location directory is an export directory table.

7. The method of claim 1 wherein the communications module is in the PE (Portable Executable) format.

8. The method of claim 1 further comprising the step of scanning the send function to confirm the presence of malicious code.

9. The method of claim 8 wherein the declaration of malicious code is confirmed when the scanning step identifies a signature of known malicious code within the send function.

10. The method of claim 8 wherein the declaration of malicious code is rescinded when the scanning step uncovers evidence suggesting that malicious code is not present within the send function.

11. The method of claim 10 wherein the evidence comprises the existence of a jump instruction at a beginning portion of the send function.

12. The method of claim 10 wherein the evidence comprises a large number of items from the group of items comprising zeroes within the send function and non-operations within the send function.

13. A computer implemented method for detecting corrupted code within a computer, said method comprising the steps of:

searching for a communications module within the computer;

examining a function location directory within the communications module;

locating a send function within the function location directory;

declaring the presence of corrupted code when the function location directory states that the send function is slated to start executing at a location outside the communications module; and

excising malicious code detected within the send function.

14. Apparatus for countering malicious code infections that spread from a first computer to a second computer, said apparatus comprising:

a module for searching for a communications module within the first computer;

coupled to the searching module, a module for examining a function location directory within the communications module;

coupled to the examining module, a module for locating a send function within the function location directory;

coupled to the locating module, a module for declaring the presence of malicious code when the function location directory states that the send function is slated to start executing at non-normal location; and

coupled to the declaring module, a module for excising malicious code detected within the send function.

15. The apparatus of claim 14 further comprising:

coupled to the declaring module, a module for scanning the send function for malicious code.

16. The apparatus of claim 14 further comprising:

coupled to the declaring module, a module for excising malicious code detected within the send function.

17. The apparatus of claim 14 wherein the non-normal location is within a slack region of a code section within the communications module.

18. The apparatus of claim 14 wherein the non-normal location is within a section of the communications module other than a code section.

19. The apparatus of claim 14 wherein the non-normal location is outside the communications module.

20. A computer-readable storage medium containing computer code for countering malicious code infections that spread from a first computer to a second computer, said computer code comprising instructions for performing the steps of:

searching for communications module within the first computer;

examining a function location directory within the communications module;

locating send function within the function location directory;

declaring the presence of malicious code when the function location directory states that the send function is slated to start executing at a non-normal location; and

excising malicious code detected within the send function.

21. The computer-readable medium of claim 20 wherein the non-normal location is within a slack region of a code section within the communications module.

22. The computer-readable medium of claim 20 wherein the non-normal location is within a section of the communications module other than a code section.

23. The computer-readable medium of claim 20 wherein the non-normal location is outside the communications module.