System and method for scanning memory for pestware
Systems and methods for managing multiple related pestware processes on a protected computer are described. One embodiment is configured to identify a location of each of a plurality of files in at least one file storage device of the protected computer and store a list of the location of each of the plurality of files. The list of the plurality of files is then sorted so as to generate a sorted list. Each of the plurality of files is then sequentially accessed as listed in the sorted list so as to retrieve information from each of the plurality of files. Information from the plurality of files is then analyzed to determine whether any of the plurality of files are potential pestware files. In variations, the files in the file storage device are enumerated, and information from the files is accessed, by circumventing the operating system of the protected computer.
1. A method for scanning executable memory of a protected computer for pestware comprising:
enumerating a process and at least one dependency related to the process, wherein the process and the at least one dependency are running in the executable memory, and the at least one dependency includes encrypted code;
identifying a reference point in the executable memory for the process and at least one other reference point in the executable memory for the at least one dependency; and
scanning at least one portion of memory for unencrypted code spawned from the encrypted code, the unencrypted code located at an offset from the at least one other reference point in the executable memory so as to identify whether code indicative of a pestware process resides in the executable memory at the at least one portion of memory.
2. The method of claim 1 , including:
enumerating a base address for the process and at least one base address for the at least one dependency;
obtaining an original entry point (OEP) for the process and at least one OEP for the at least one dependency; and
identifying, utilizing the at least one OEP for the at least one dependency and the at least one base address for the at least one dependency, at least one start address for the at least one dependency, wherein the at least one start address is the at least one other reference point in the executable memory.
3. The method of claim 2 wherein the obtaining the at least one OEP for the at least one dependency includes parsing at least one portable execution header (PE) so as to identify the OEP.
4. The method of claim 1 wherein the enumerating includes enumerating blocks of the executable memory associated with the process and the at least one dependency.
5. The method of claim 1 including:
accessing a file stored in a hard drive of the protected computer that corresponds to the process so as to retrieve information about the file; and
selecting, based upon the information about the file, the offset.
6. The method of claim 1 , wherein the reference point in the executable memory for the process is identified as an API implementation.
7. A system for managing pestware comprising:
a protected computer including at least one file storage device and executable memory;
a pestware detection module configured to detect pestware on the protected computer, wherein the pestware detection module is configured to:
enumerate a process and at least one dependency related to the process, wherein the process and the at least one dependency are running in the executable memory and the at least one dependency includes encrypted code;
identify a reference point in the executable memory for the process and at least one other reference point in the executable memory for the at least one dependency; and
scan at least one portion of memory for unencrypted code spawned from the encrypted code, the unencrypted code located at an offset from the at least one other reference point in the executable memory so as to identify whether code indicative of a pestware process resides in the executable memory at the at least one portion of memory.
8. The system of claim 7 , wherein the pestware detection module is configured to:
enumerate a base address for the process and at least one base address for the at least one dependency;
obtain an original entry point (OEP) for the process and at least one OEP for the at least one dependency; and
identify, utilizing the at least one OEP for the at least one dependency and the at least one base address for the at least one dependency, at least one start address for the at least one dependency, wherein the at least one start address is the at least one other reference point in the executable memory.
9. The system of claim 8 wherein pestware detection module is configured to obtain the at least one OEP for the at least one dependency by parsing at least one portable execution header (PE) so as to identify the OEP.
10. The system of claim 7 wherein the pestware detection module is configured to enumerate blocks of the executable memory associated with the process and the at least one dependency.
11. The system of claim 7 wherein the at least one portion of memory is outside of memory where the at least one dependency resides.
12. The system of claim 7 wherein the pestware detection module is configured to:
access a file stored in the file storage device of the protected computer that corresponds to the process so as to retrieve information about the file; and select, based upon the information about the file, the offset.
13. The system of claim 7 , wherein the reference point in the executable memory for the process is identified as an API implementation.
14. A computer readable storage medium having stored thereon instructions to scan for pestware on a protected computer including an executable memory, the instructions including:
enumerating a process and at least one dependency related to the process, wherein the process and the at least one dependency are running in the executable memory and the at least one dependency includes encrypted code;
identifying a reference point in the executable memory for the process and at least one other reference point in the executable memory for the at least one dependency; and
scanning at least one portion of memory for unencrypted code spawned from the encrypted code, the unencrypted code located at an offset from the at least one other reference point in the executable memory so as to identify whether code indicative of a pestware process resides in the executable memory at the least one portion of memory.
15. The computer readable storage medium of claim 14 , the instructions further including:
enumerating a base address for the process and at least one base address for the at least one dependency;
obtaining an original entry point (OEP) for the process and at least one OEP for the at least one dependency; and
identifying, utilizing the at least one OEP for the at least one dependency and the at least one base address for the at least one dependency, at least one start address for the at least one dependency, wherein the at least one start address is the at least one other reference point in the executable memory.
16. The computer readable storage medium of claim 15 wherein the instructions for obtaining the at least one OEP for the at least one dependency include instructions for parsing at least one portable execution header (PE) so as to identify the OEP.
17. The computer readable storage medium of claim 14 wherein the enumerating includes enumerating blocks of the executable memory associated with the process and the at least one dependency.
18. The computer readable storage medium of claim 14 wherein the at least one portion of memory is outside of memory, and wherein the instructions include instructions for scanning for the unencrypted code outside of memory where the at least one dependency resides.
19. The computer readable storage medium of claim 14 , the instructions including:
accessing a file stored in a hard drive of the protected computer that corresponds to the process so as to retrieve information about the file; and selecting, based upon the information about the file, the offset.
20. The computer readable storage medium of claim 14 , wherein the reference point in the executable memory for the process is identified as an API implementation.