Heuristically detecting spyware/adware registry activity

1. A method for detecting the presence of malicious computer code in a computer, said method comprising the steps of:

examining persistence points associated with an operating system of the computer, persistence points being items that remain associated with the operating system when the operating system is rebooted;

determining whether a pointer from a persistence point to a temporary directory is present in the computer; and

when a pointer to a temporary directory from a persistence point is found, declaring a suspicion of malicious code being present in the computer.

2. The method of claim 1 wherein a persistence point is a location from the group of locations consisting of:

registry locations;

short-cut locations; and

initialization files.

3. A method for detecting the presence of malicious computer code in a computer, said method comprising the steps of:

verifying that the computer has a native operating system for controlling hardware functions of the computer and a different user-interface operating system built on top of the native operating system, wherein the native operating system comprises native application program interfaces (APIs), and wherein the user-interface operating system comprises different user-interface APIs;

scanning for a registry value pointing to a file having a path length greater than a maximum path length allowed by the user-interface APIs of the user-interface operating system and the file using a path syntax associated with the native APIs of the native operating system; and

responsive to detecting a registry value pointing to a file, the file having a path length greater than a maximum path length allowed by the user-interface APIs of the user-interface operating system and the file using a path syntax associated with the native APIs of the native operating system, declaring a suspicion of malicious code being present in the computer.

4. The method of claim 3 wherein the native operating system is WindowsNT, the user-interface operating system is Windows32, and the path syntax for the native operating system is UNC.

5. A method for detecting the presence of malicious computer code in a computer, said method comprising the steps of:

verifying that the computer has a native operating system for controlling hardware functions of the computer and a different user-interface operating system built on top of the native operating system, wherein the native operating system comprises native application program interfaces (APIs) that do not expect registry values terminating in null characters, and wherein the user-interface operating system comprises different user-interface APIs that expect registry values terminating in null characters;

scanning for a registry value having a null character as the last character of the value; and

when a registry value having a null character as the last character of the value is detected, declaring a suspicion of malicious code being present in the computer.

6. The method of claim 5 wherein the registry value having a null character as the last character of the value is associated with a persistence point, the persistence point being an item that remains associated with the native operating system when the native operating system is rebooted.

7. The method of any one of claim 1 , 3 , or 5 wherein, following the step of declaring a suspicion of malicious code being present in the computer, at least one of the following steps is performed:

blocking the suspected malicious code from executing;

monitoring a location where the suspected malicious code is present; and

subjecting the suspected malicious code to further investigation.

8. A computer-readable non-transitory storage medium containing computer program instructions executable on a processor for detecting the presence of malicious computer code in a computer, said computer program instructions performing steps comprising:

examining persistence points associated with an operating system of the computer, persistence points being items that remain associated with the operating system when the operating system is rebooted;

determining whether a pointer from a persistence point to a temporary directory is present in the computer; and

when a pointer to a temporary directory from a persistence point is found, declaring a suspicion of malicious code being present in the computer.

9. The computer-readable non-transitory storage medium of claim 8 wherein a persistence point is a location from the group of locations consisting of:

registry locations;

short-cut locations; and

initialization files.

10. A computer-readable non-transitory storage medium containing computer program instructions executable on a processor for detecting the presence of malicious computer code in a computer, said computer program instructions performing steps comprising:

verifying that the computer has a native operating system for controlling hardware functions of the computer and a different user-interface operating system built on top of the native operating system, wherein the native operating system comprises native application program interfaces (APIs), and wherein the user-interface operating system comprises different user-interface APIs;

scanning for a registry value pointing to a file having a path length greater than a maximum path length allowed by the user-interface APIs of the user-interface operating system and the file using a path syntax associated with the native APIs of the native operating system; and

responsive to detecting a registry value pointing to a file, the file having a path length greater than a maximum path length allowed by the user-interface APIs of the user-interface operating system and the file using a path syntax associated with the native APIs of the native operating system, declaring a suspicion of malicious code being present in the computer.

11. The computer-readable non-transitory storage medium of claim 10 wherein the native operating system is WindowsNT, the user-interface operating system is Windows32, and the path syntax for the native operating system is UNC.

12. A computer-readable non-transitory storage medium containing computer program instructions executable on a processor for detecting the presence of malicious computer code in a computer, said computer program instructions performing steps comprising:

verifying that the computer has a native operating system for controlling hardware functions of the computer and a different user-interface operating system built on top of the native operating system, wherein the native operating system comprises native application program interfaces (APIs) that do not expect registry values terminating in null characters, and wherein the user-interface operating system comprises different user-interface APIs that expect registry values terminating in null characters;

scanning for a registry value having a null character as the last character of the value; and

when a registry value having a null character as the last character of the value is detected, declaring a suspicion of malicious code being present in the computer.

13. The computer-readable non-transitory storage medium of claim 12 wherein the registry value having a null character as the last character of the value is associated with a persistence point, the persistence point being an item that remains associated with the native operating system when the native operating system is rebooted.

14. The computer-readable non-transitory storage medium of any one of claim 8 , 10 , or 12 wherein, following the step of declaring a suspicion of malicious code being present in the computer, at least one of the following steps is performed:

blocking the suspected malicious code from executing;

monitoring a location where the suspected malicious code is present; and

subjecting the suspected malicious code to further investigation.

15. Apparatus for detecting the presence of malicious computer code in a computer, said apparatus comprising:

means for examining persistence points associated with an operating system of the computer, persistence points being items that remain associated with the operating system when the operating system is rebooted;

coupled to the examining means, means for detecting a pointer from a persistence point to a temporary directory; and

coupled to the detecting means, means for declaring a suspicion of malicious code being present in the computer when the detecting means finds a pointer to a temporary directory from a persistence point.

16. Apparatus for detecting the presence of malicious computer code in a computer, said apparatus comprising:

a module for verifying that the computer has a native operating system for controlling hardware functions of the computer and a different user-interface operating system built on top of the native operating system, wherein the native operating system comprises native application program interfaces (APIs), and wherein the user-interface operating system comprises different user-interface APIs;

an investigation module for scanning for a registry value pointing to a file having a path length greater than a maximum path length allowed by the user-interface APIs of the user-interface operating system and the file using a path syntax associated with the native APIs of the native operating system; and

coupled to the investigation module, a declaration module for declaring a suspicion of malicious code being present in the computer responsive to the investigation module detecting a registry value pointing to a file, the file having a path length greater than a maximum path length allowed by the user-interface APIs of the user-interface operating system and the file using a path syntax associated with the native APIs of the native operating system.

17. Apparatus for detecting the presence of malicious computer code in a computer, said apparatus comprising:

a module for verifying that the computer has a native operating system for controlling hardware functions of the computer and a different user-interface operating system built on top of the native operating system, wherein the native operating system comprises native application program interfaces (APIs) that do not expect registry values terminating in null characters, and wherein the user-interface operating system comprises different user-interface APIs that expect registry values terminating in null characters;

a detection module for scanning for a registry value having a null character as the last character of the value; and

coupled to the detection module, a declaration module for declaring a suspicion of malicious code being present in the computer when the detection module detects a registry value having a null character as the last character of the value.