Detecting a malware process

1. A system, comprising:

a processor configured to:

in response to a completion of launch of a process and prior to an execution of the process, determine a first base address associated with the process, wherein the first base address associated with the process is associated with a first memory block from which instructions associated with the process are to be read and executed;

determine whether the first memory block associated with the first base address is associated with a write permissible permission; and

in response to the determination that the first memory block associated with the first base address associated with the process is associated with the write permissible permission:

determine whether a portable executable (PE) header code included in a memory image associated with the process matches a designated code associated with an ordinary process, wherein a second base address associated with the ordinary process is associated with a second memory block that is associated with a read-only permission;

determine whether the process is potentially associated with a malware process, the determination being based at least in part on whether the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process; and

in response to the determination that the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process:

determine that the process is potentially associated with the malware process; and

prevent the execution of the process; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein the processor is further configured to:

in response to the determination that the first memory block associated with the first base address is not associated with the write permissible permission:

determine that the process is not potentially associated with the malware process; and

permit the execution of the process.

3. The system of claim 1 , wherein the first base address is determined based at least in part on a return address associated with an extended instructed pointer (EIP) information corresponding to the process.

4. The system of claim 1 , wherein the first base address is recorded by an operating system.

5. The system of claim 1 , wherein the write permissible permission comprises a write-only permission or a reading and writing permissible permission.

6. The system of claim 1 , wherein in response to the determination that the PE header code included in the memory image associated with the process does match the designated code associated with the ordinary process:

determine that the process is potentially not associated with the malware process; and

permit the execution of the process.

7. The system of claim 1 , wherein the processor is further configured to compare the PE header code included in the memory image associated with the process to a predetermined list of designated codes.

8. A method, comprising:

in response to a completion of launch of a process and prior to an execution of the process, determining a first base address associated with the process, wherein the first base address associated with the process is associated with a first memory block from which instructions associated with the process are to be read and executed;

determining whether the first memory block associated with the first base address is associated with a write permissible permission; and

in response to the determination that the first memory block associated with the first base address associated with the process is associated with the write permissible permission:

determining whether a portable executable (PE) header code included in a memory image associated with the process matches a designated code associated with an ordinary process, wherein a second base address associated with the ordinary process is associated with a second memory block that is associated with a read-only permission;

determining whether the process is potentially associated with a malware process, the determination being based at least in part on whether the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process; and

in response to the determination that the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process:

determining that the process is potentially associated with the malware process; and

preventing the execution of the process.

9. The method of claim 8 , further comprising:

in response to the determination that the first memory block associated with the first base address is not associated with the write permissible permission:

determining that the process is not potentially associated with the malware process; and

permitting the execution of the process.

10. The method of claim 8 , wherein the first base address is determined based at least in part on a return address associated with an extended instructed pointer (EIP) information corresponding to the process.

11. The method of claim 8 , wherein the first base address is recorded by an operating system.

12. The method of claim 8 , wherein the write permissible permission comprise a write-only permission or a reading and writing permissible permission.

13. The method of claim 8 , wherein in response to the determination that the PE header code included in the memory image associated with the process does match the designated code associated with the ordinary process:

determining that the process is potentially not associated with the malware process; and

permitting the execution of the process.

14. The method of claim 8 , further comprising comparing the PE header code included in the memory image associated with the process to a predetermined list of designated codes.

15. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

in response to a completion of launch of a process and prior to an execution of the process, determining a first base address associated with the process, wherein the first base address associated with the process is associated with a first memory block from which instructions associated with the process are to be read and executed;

determining whether the first memory block associated with the first base address is associated with a write permissible permission; and

in response to the determination that the first memory block associated with the first base address associated with the process is associated with the write permissible permission:

determining whether a portable executable (PE) header code included in a memory image associated with the process matches a designated code associated with an ordinary process, wherein a second base address associated with the ordinary process is associated with a second memory block that is associated with a read-only permission;

determining whether the process is potentially associated with a malware process, the determination being based at least in part on whether the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process; and

in response to the determination that the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process:

determining that the process is potentially associated with the malware process; and

preventing the execution of the process.

16. The system of claim 1 , wherein in the event that the determination that the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process, the processor is further configured to:

determine that the process is not a special process, wherein a third base address associated with the special process is associated with a third memory block that is not associated with the read-only permission.