System and method for detection of malicious code in the address space of processes

A system for detecting malicious code comprising:

• a malicious code signature database containing signatures of malicious code;
• and
• a computer system comprising:
• an intercept module configured to:
• detect a launching of a trusted process from a trusted executable file executing on a computer system;
• detect access to a suspicious address within a suspicious memory area in an address space of the trusted process, wherein the suspicious memory area is a memory area that lies outside the boundaries of a trusted executable image representing the trusted executable file and is an executable memory area;
• analyze one or more memory areas within a vicinity of the suspicious address space in the computer system to determine whether another executable image representing another executable file is located in the one or more memory areas;
• and
• a security module configured to:
• determine that malicious code is contained in the address space of the process when the another executable image contains malicious code;
• and
• performe one of remove, halt or quarantine the malicious code from the address space of the trusted process.

A computer-readable medium, storing theron instructions that when executed by a processor perfor a method for detecting malicious code comprising:

• detecting a launching of a trusted process from a trusted executable file executing on a computer system;
• detecting access to a suspicious address space within a suspicious memory area in an address space of the trusted process, wherein the suspicious memory area is a memory area that lies outside the boundaries of the trusted executable image representing the trusted executable file and is an executable memory area;
• analyzing one or more memory areas within a vicinity of the suspicious the address space in the computer system to determine whether another executable image representing another executable file is located in the one or more memory areas;
• analyzing the another executable image to determine whether the another executable image contains malicious code;
• concluding malicious code is contained in the address space of the trusted process when the another executable image contains malicious code;
• and
• performing one of removing, halting or quaranting the malicious code from the address space of the trusted process.