Systems and methods for identifying malware distribution sites

• US 20070006310A1
• Filed: 06/30/2005
• Published: 01/04/2007
• Est. Priority Date: 06/30/2005
• Status: Abandoned Application

• Current Assignee: Paul Piccard
• Original Assignee: Paul Piccard
• Inventors: Piccard, Paul
• Application Number:
  US11/171,924
• Publication Number:
  US 20070006310A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/562 Static detection

Abstract

Systems and methods for identifying malware distribution sites are described. In one embodiment, a system includes a malware detection module configured to analyze a file of a protected computer to determine that the file is associated with malware. The system also includes a Web site identification module configured to search a download history log of the protected computer to identify a Web site from which the file was downloaded.

Claims

1. A method of neutralizing a malware process, comprising:

identifying a malware process;

accessing at least one function exported by said malware process; and

writing an instruction into the memory for said at least one exported function that renders said at least one exported function substantially ineffective.

2. The method of claim 1, wherein the accessing at least one function exported by said malware process comprises:

reading a memory address corresponding to said at least one export function;

populating a list with said at least one export function memory address; and

advancing through said list of at least one export function memory address to access said at least one export function.

3. The method of claim 1, wherein said instruction written into memory for each of said exported functions is a return instruction that causes each of said exported functions, when accessed by the malware process, to return without executing malware instructions within each respective exported function.

4. The method claim of claim 3, wherein said return instruction initiates a jump to a proper return value within the instructional code of said at least one export function.

5. The method of claim 1, wherein the identifying the malware process includes using a technique selected from the group consisting of a definition matching approach, a heuristics approach, and a dynamic offset scanning approach.

6. The method of claim 1, wherein said malware process is a dynamic link library.

7. The method of claim 1, wherein the identifying a malware process, accessing each function exported by said malware process, and writing, an instruction into the memory for each of said exported functions that renders each of said exported functions substantially ineffective are performed at a computer, the method further comprising:

deleting registry entries associated with said malware process; and

scheduling said malware process for deletion after the next reboot.