System and method for detecting malware injected into memory of a computing device

1. A method of detecting malicious code in a computing device comprising a processor executing an operating system and a malicious code detection module, memory, and a non-volatile storage device, the method comprising:

identifying, by the malicious code detection module, a call stack for a thread of execution within the operating system that includes an originating module and an attribute table;

assigning, by the malicious code detection module, a unique identifier to the call stack; and

when a top of the call stack contains a call to an application programing interface of the operating system:

determining, by the malicious code detection module, the originating module that initiated a stack frame in the call stack,

wherein the determining step is performed for additional stack frames in the call stack until a threshold or event is reached,

wherein the threshold or event is based on stack frames, to be analyzed by the malicious code detection module, that were added to the call stack within a specific time period; and

generating an alert, by the malicious code detection module, when the attribute table associated with the originating module indicates that the originating module is not backed by a file stored in the non-volatile storage device.

2. The method of claim 1 , wherein the malicious code detection module is part of a kernel of the operating system.

3. The method of claim 1 , wherein the malicious code detection module is not part of the operating system.

4. A method of detecting malicious code in a computing device comprising a processor executing an operating system and a malicious code detection module, memory, and a non-volatile storage device, the method comprising:

identifying, by the malicious code detection module, a call stack for a thread of execution within the operating system that includes an originating module and an attribute table;

assigning, by the malicious code detection module, a unique identifier to the call stack; and

when a top of the call stack contains a call to an application programing interface of the operating system:

determining, by the malicious code detection module, the originating module that initiated a stack frame in the call stack,

wherein the determining step is performed for additional stack frames in the call stack until a threshold or event is reached,

wherein the threshold or event is based on stack frames, to be analyzed by the malicious code detection module, that were added to the call stack within a specific time period; and

suspending, by the malicious code detection module, the thread of execution containing the originating module when the attribute table associated with the originating module indicates that the originating module is not backed by a file stored in the non-volatile storage device.

5. The method of claim 4 , wherein the malicious code detection module is part of a kernel of the operating system.

6. The method of claim 4 , wherein the malicious code detection module is not part of the operating system.

7. A computing device comprising: a processor executing an operating system and a malicious code detection module; memory; and a non-volatile storage device;

wherein the malicious code detection module comprises instructions for: identifying a call stack for a thread of execution that includes an originating module and an attribute table within the operating system;

assigning, by the malicious code detection module, a unique identifier to the call stack; and

when a top of the call stack contains a call to an application programing interface of the operating system:

determining the originating module that initiated a stack frame in the call stack,

wherein the malicious code detection module further comprises instructions for performing the determining step for additional stack frames in the call stack until a threshold or event is reached,

wherein the threshold or event is based on stack frames, to be analyzed by the malicious code detection module, that were added to the call stack within a specific time period; and

generating an alert if the attribute table associated with the originating module indicates that the originating module is not backed by a file stored in the non-volatile storage device.

8. The device of claim 7 , wherein the malicious code detection module is part of a kernel of the operating system.

9. The device of claim 7 , wherein the malicious code detection module is not part of the operating system.

10. The device of claim 7 , wherein the malicious code detection module further comprises instructions for: suspending the thread of execution containing the originating module if the originating module is not backed by a file stored in the non-volatile storage device.

11. A method of detecting malicious code in a computing device, the method comprising:

identifying, using a processor, a call stack for a thread of execution that includes an originating module and an attribute table within an operating system;

assigning, by a malicious code detection module, a unique identifier to the call stack; and

when a top of the call stack contains a system call from an operating system library to an application programing interface of the operating system:

analyzing, using the processor, the call stack in reverse order in which stack frames were added to the call stack, the analyzing comprising:

when the call stack does not include a direct call from the thread of execution to the operating system, determining that the thread is non-malicious; and

when the call stack includes a direct call from the thread of execution to an application programming interface of the operating system:

determining the originating module that initiated a stack frame in the call stack; and when the attribute table associated with the originating module indicates that the originating module is not backed by a file stored in the non-volatile storage device, determining that the thread is malicious,

wherein the malicious code detection module further comprises instructions for performing the step of determining the originating module that initiated a stack frame in the call stack, for additional stack frames in the call stack until a threshold or event is reached, and

wherein the threshold or event is based on stack frames, to be analyzed by the malicious code detection module, that were added to the call stack within a specific time period.

12. The method of claim 11 , further comprising, in response to determining that the thread is malicious, generating an alert.

13. The method of claim 12 , wherein the malicious code detection module is part of a kernel of the operating system.

14. The method of claim 12 , wherein the malicious detection module is not part of the operating system.

15. The method of claim 1 , further comprising enumerating the call stack and the additional call stacks.

16. The method of claim 1 , further comprising assigning, by the malicious code detection module, a unique identifier to each of the additional call stacks.

17. The method of claim 1 , wherein the threshold or event is based on a specified number of stack frames to be analyzed by the malicious code detection module.

18. The method of claim 1 , further comprising determining, by the malicious code detection module, a return address for the stack frame.

19. The method of claim 4 , further comprising determining, by the malicious code detection module, a return address for the stack frame.

20. The device of claim 7 , wherein the malicious code detection module further comprises instructions for determining a return address for the stack frame.