Determining the source of malware

• US 8,321,910 B1
• Filed: 01/20/2006
• Issued: 11/27/2012
• Est. Priority Date: 01/21/2005
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: English, Edward D., Grindrod, Geoffrey B.
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Woldemariam, Nega
• Application Number:
  US11/337,054
• Time in Patent Office: 2,503 Days
• Field of Search: 713/153, 713/163, 713/183, 713/193, 713/340, 713/164, 713/150, 714/38, 714/49, 714/48, 714/35, 714/37, 709/203, 709/217, 709/223, 709/237, 709/225, 709/229, 709/227, 726/22, 726/14, 726/13, 726/11, 726/34, 726/25, 726/26, 726/27, 380/42, 380/55, 380/58, 380/46, 382/225, 382/581, 375/340, 345/581, 345/55, 707/E17.128, 707/E17.129, 707/E17.118
• US Class Current: 726/2
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy

Abstract

A malware detection system capable of detecting and removing malware from a computer system. The malware detection system determines whether there are files potentially related to a selected malware file using a time-based embodiment based on whether files were installed around the time of the malware. A cache-based embodiment searches an Internet cache to determine the URLs that might be the source of the malware. A location-based embodiment dissects the file system path to determine an application related to the malware. Results are displayed to the user for action.

Claims

1. A method for determining a source of a selected malware file in a user computer system, the method comprising:

receiving a selection from a user on a first graphical user interface identifying a known malware file in said user computer system for analysis;

receiving on said first graphical user interface an indication from said user to execute a function to determine said source of said known malware file;

determining the creation date of said selected malware file;

searching a file system associated with said user computer system for a file based on said creation date of the selected malware file;

locating said file, said file being different from said malware file;

determining that the creation date of said file of said file system matches said creation date of said selected malware file; and

generating source information identifying at least one potential source of said selected malware file based on said matching, said source information including said file;

providing a second graphical user interface for displaying the source information, wherein said source information includes a file name of said file; and

displaying said source information on said computer system.

2. The method of claim 1, wherein the creation date of said selected malware file includes the date and time said selected malware file was created.

3. The method of claim 1, wherein searching the file system comprises executing a recursive directory search to iterate through all files under a defined root directory.

4. The method of claim 1, wherein the second graphical user interface displays directory paths associated with one or more files identified as potential sources of said selected malware file.

5. The method of claim 1, wherein the second graphical user interface displays one or more options selectable by a user to analyze or remove at least said files identified as a potential sources of said selected malware file.

6. The method of claim 1, wherein the creation date of said file of said file system matches the creation date of the selected malware file when the creation dates are within a specified time period.

7. A method for determining an internet source of a selected malware file in a user computer system, the method comprising:

receiving a selection from a user on a first graphical user interface identifying a known malware file in said user computer system for analysis;

receiving on said first graphical user interface an indication from said user to execute a function to determine said source of said known malware file;

determining the file name of said selected malware file using said computer system;

searching an internet cache associated with said user computer system based on the file name of said selected malware file, said internet cache including URL history entries and being maintained by a Web browser of said user computer system;

determining that a URL history entry belonging to said internet cache contains the file name of said selected malware file; and

generating source information, by said computer system, identifying at least one potential internet source of said selected malware file based on said URL history entry;

providing a second graphical user interface for displaying said source information; and

displaying said source information on said computer system.

8. The method of claim 7, wherein searching the internet cache comprises:

iterating through each URL history entry belonging to said internet cache.

9. The method of claim 7, wherein the second graphical user interface displays directory paths associated with one or more files identified as potential sources of said selected malware file.

10. The method of claim 7, wherein the second graphical user interface displays one or more options selectable by a user to analyze or remove at least one of the potential sources of said selected malware file.

11. A method for determining the name of an application associated with a selected malware file in a user computer system, the method comprising:

receiving a selection from a user on a first graphical user interface identifying a known malware file in said user computer system for analysis;

receiving on said first graphical user interface an indication from said user to execute a function to determine a source of said known malware file;

determining the full path file name of said selected malware file using said computer system;

parsing the full path file name into segments based on their association with said malware file;

determining that one of said segments is a root directory of said malware file;

determining the name of the application which may have installed said malware file based upon said determined root directory; and

generating source information, by said computer system, identifying the name of the application associated with said selected malware file based on said root directory;

providing a second graphical user interface for displaying the source information; and

displaying said source information on said computer system.

12. The method of claim 11, wherein the second graphical user interface displays directory paths associated with the application identified as a source of said selected malware file.

13. The method of claim 11, wherein the second graphical user interface displays one or more options selectable by a user to analyze or remove the application identified as a source of said selected malware file.

14. A method for determining the source of a selected malware file in a user computer system, the method comprising:

executing an anti-malware application in said computer system;

displaying a list of malware to a user on a first graphical user interface;

receiving a selection from a user identifying said malware file to determine the source of the selected malware file;

receiving on said first graphical user interface an indication from said user to execute a function to determine said source of said known malware file;

determining at least one file installed at the same time as said selected malware file using a creation date of said malware file;

determining at least one URL including the file name of said selected malware file by reference to an internet cache of URL history entries;

determining at least one software application related to said selected malware file by reference to a root directory of a full path name of said malware file; and

displaying, on a second graphical user interface, said at least one file, said at least one URL, and said at least one software application to said user on said computer system as being potential sources of said selected malware file.

15. The method of claim 14 further comprising:

displaying on said second graphical user interface one or more options selectable by said user to analyze or remove at least one of said potential sources of said selected malware file.