System and method for scanning memory for pestware offset signatures
First Claim
1. A method for scanning executable memory of a protected computer for pestware comprising:
- identifying at least one reference point in the executable memory of the protected computer, wherein the at least one reference point is associated with a process being executed by the protected computer via the executable memory of the protected computer, wherein the process is potentially a predetermined type of pestware;
selecting a first offset and a second offset based on the predetermined type of pestware;
accessing the memory at the first offset from the at least one reference point so as to identify a first set of information in the executable memory that begins at the first offset from the at least one reference point;
accessing the memory at the second offset from the at least one reference point so as to identify a second set of information in the executable memory that begins at the second offset from the at least one reference point; and
wherein the first and second sets of information are separated in the executable memory by information not included in the first and second sets of information wherein the second set of information is spawned from the first set of information upon execution of the first set of information in the executable memory, and wherein the process is identifiable as the predetermined type of pestware when the first and second sets of information each include information specific to the predetermined type of pestware.
9 Assignments
0 Petitions
Accused Products
Abstract
Systems and methods for managing pestware processes on a protected computer are described. In one implementation, a reference point in the executable memory that is associated with a process running in the executable memory is located. A first and second sets of information from corresponding first and second portions of the executable memory are then retrieved. The first and second portions of the executable memory are separated by a defined offset, and each of the first and second portions of the executable memory are offset from the reference point. The process is identifiable as a particular type of pestware when the first and second sets of information each include information previously found to be separated by the defined offset in other processes that are of the particular type of pestware. In some variations, the reference point is a starting address and/or an API implementation in the process.
64 Citations
16 Claims
-
1. A method for scanning executable memory of a protected computer for pestware comprising:
-
identifying at least one reference point in the executable memory of the protected computer, wherein the at least one reference point is associated with a process being executed by the protected computer via the executable memory of the protected computer, wherein the process is potentially a predetermined type of pestware; selecting a first offset and a second offset based on the predetermined type of pestware; accessing the memory at the first offset from the at least one reference point so as to identify a first set of information in the executable memory that begins at the first offset from the at least one reference point; accessing the memory at the second offset from the at least one reference point so as to identify a second set of information in the executable memory that begins at the second offset from the at least one reference point; and wherein the first and second sets of information are separated in the executable memory by information not included in the first and second sets of information wherein the second set of information is spawned from the first set of information upon execution of the first set of information in the executable memory, and wherein the process is identifiable as the predetermined type of pestware when the first and second sets of information each include information specific to the predetermined type of pestware. - View Dependent Claims (2, 3, 4)
-
-
5. A method for scanning executable memory of a protected system for pestware comprising:
-
locating a reference point in the executable memory that is associated with a process being executed by a computer via the executable memory; retrieving a first set of information from a first portion of the executable memory and a second set of information from a second portion of the executable memory, wherein the first and second portions of the executable memory are separated by a defined offset based on a predetermined type of pestware, and wherein each of the first and second portions of the executable memory are offset from the reference point; identifying the process as the predetermined type of pestware when the first and second sets of information each include information previously found to be separated by the defined offset in other processes that are specific to the predetermined type of pestware wherein the second set of information is spawned from the first set of information upon execution of the first set of information in the executable memory; and scanning a file of a hard drive associated with the process to obtain information about the file, wherein the defined offset varies based upon the information about the file. - View Dependent Claims (6, 7, 8)
-
-
9. A system for managing pestware comprising:
-
a protected computer; a pestware removal module configured to remove pestware on the protected computer, the protected computer including at least one file storage device and an executable memory; and a pestware detection module configured to; locate a reference point in the executable memory that is associated with a process being executed by the protected computer via the executable memory, retrieve a first set of information from a first portion of the executable memory and a second set of information from a second portion of the executable memory, wherein the first and second portions of the executable memory are separated by a defined offset based on a predetermined type of pestware, and wherein each of the first and second portions of the executable memory are offset from the reference point, identify the process as the predetermined type of pestware when the first and second sets of information each include information previously found to be separated by the defined offset in other processes that are specific to the predetermined type of pestware, wherein the second set of information is spawned from the first set of information upon execution of the first set of information in the executable memory; and scan a file of a hard drive associated with the process to obtain information about the file, and wherein the defined offset varies based upon the information about the file. - View Dependent Claims (10, 11, 12)
-
-
13. A computer readable storage medium storing instructions for scanning executable memory on a protected computer for pestware, the instructions including instructions for:
-
locating a reference point in the executable memory that is associated with a process being executed by the protected computer via the executable memory; retrieving a first set of information from a first portion of the executable memory and a second set of information from a second portion of the executable memory, wherein the first and second portions of the executable memory are separated by a defined offset based on a predetermined type of pestware, and wherein each of the first and second portions of the executable memory are offset from the reference point; identifying the process as the predetermined type of pestware when the first and second sets of information each include information previously found to be separated by the defined offset in other processes that are specific to the predetermined type of pestware wherein the second set of information is spawned from the first set of information upon execution of the first set of information in the executable memory; and scanning a file of a hard drive associated with the process to obtain information about the file, wherein the defined offset varies based upon the information about the file. - View Dependent Claims (14, 15, 16)
-
Specification