Malware detection
View Patent ↗According to a first aspect of the present invention there is provided a method of operating a computer to detect malware, which malware writes a copy of an executable file to a non-volatile memory of the computer and creates a launch point that causes that executable file to be run at start-up of the computer. The method includes, during the shutdown procedures of the computer, monitoring the creation and/or modification of any launch points and, for any such modification or creation, saving a further copy of any executable file associated with the launch point to the non-volatile memory, and, following a subsequent start-up of the computer, examining said further copy to determine if it is potential malware.
1. A method of operating a computer to detect malware, which malware writes a copy of an executable file to a non-volatile memory of the computer and creates a launch point that causes that executable file to be run at start-up of the computer, the method comprising:
during first shutdown procedures of the computer, detecting the creation and/or modification of any launch points and saving a further copy of any executable file associated with a detected launch point to the non-volatile memory; and
following a subsequent start-up of the computer, examining said further copy to determine that said saved further copy is malware, and then initiating second shutdown procedures of the computer; and
during the second shutdown procedures, deleting the created and/or modified launch point associated with the executable file and deleting the executable file from the non-volatile memory of the computer.
2. A method as claimed in claim 1 , wherein information identifying the associated launch point is saved with each further copy of an executable file.
3. A method as claimed in claim 1 , wherein the copy of the executable file is written to a first location in the non-volatile memory and the further copy is saved to a second location in the non-volatile memory.
4. A method as claimed in claim 3 , wherein the second location in the non-volatile memory is subsequently accessed by a malware scanner, the malware scanner examining said further copy to determine if it is potential malware.
5. A method as claimed in claim 1 , wherein the step of detecting the creation and/or modification of any launch points comprises one or more of:
monitoring changes to a registry of the computer;
monitoring modifications to a boot sector of a non-volatile memory of the computer; and
monitoring the writing of data to files.
6. A method as claimed in claim 1 , wherein launch points comprise one or more of:
an executable file specified under a Run or RunOnce key;
an executable file specified to run as a system service or device driver;
an executable file specified to run as a shell;
an executable file specified to run as a debugger;
an executable file specified to run as a Winlogon notification package;
an executable file specified in the start-up folders; and
an executable file specified to run as a boot-start driver.
7. A method as claimed in claim 1 , wherein the step of examining said further copy to determine if it is potential malware comprises one or more of:
scanning the further copy for a malware signature; and
performing heuristic analysis of the further copy.
8. A method as claimed in claim 1 , and further comprising: determining that an executable file associated with a detected launch point is written to the non-volatile memory during the first shutdown procedures of the computer, and then saving a further copy of the executable file.
9. A method as claimed in claim 1 , and further comprising:
detecting initiation of the first shutdown procedures of the computer.
10. A method as claimed in claim 9 , wherein the step of detecting initiation of shutdown procedures of the computer comprises any one of:
using a user-mode driver to receive a SERVICE_CONTROL_POWEREVENT, a SERVICE_CONTROL_PRESHUTDOWN or a SERVICE_CONTROL_SHUTDOWN message;
using a kernel-mode driver to receive a IRP_MJ_SHUTDOWN IRP message; or
using an invisible window to receive a WM_QUIT message.
11. A computer system comprising:
a processor configured to detect the creation and/or modification of any launch points during first shutdown procedures of the computer system;
a memory configured to save a copy of any executable file associated with a launch point created and/or modified during the first shutdown procedures; and
the processor being further configured to examine said copy, following a subsequent start-up of the computer system, in order to determine that said saved further copy of an executable file is malware, and to then initiate second shutdown procedures of the computer; and
the processor being further configured to, during the second shutdown procedures, delete the created and/or modified launch point associated with the executable file and to delete the executable file from the non-volatile memory of the computer.
12. A non-transitory computer storage medium having stored thereon a computer program comprising computer program code adapted to perform all the steps of claim 1 when said program is run on a computer.