Back to results
US 2019/0243975 A1Published application
Persistence probing to detect malware
AssigneeMcAfee, Inc.
InventorsCraig Schmugar, John Teddy, Cedric Cochin
Life of this patent
Estimating the term…
Abstract
A technique for detecting malware looks at startup hooks that may be created by malware to assist in ensuring that the malware is started upon a reboot of a programmable device. After enumerating startup hooks in the system, startup hooks associated with untrusted executables are deleted. If the startup hook is restored, that is an indication that the untrusted executable may be malware. An indication may then be passed to an anti-malware software to analyze the executable further.
Claims20
A server computer system comprising:
- at least one processor;
- and
- memory including instructions that, when executed, cause the at least one processor to at least:
- process a reputation associated with a target executable, the reputation determined by:
- removing a startup item associated with the target executable from a programmable device;
- determining whether the startup item is restored to the programmable device within a time period after the removal;
- when the startup item is determined to be restored to the programmable device within the time period, setting the reputation of the target executable to a negative reputation;
- and
- when the startup item is determined to not be restored within the time period, setting the reputation of the target executable to a positive reputation;
- when the reputation of the target executable is a positive reputation, updating a whitelist to include the target executable;
- when the reputation of the target executable is a negative reputation, updating a blacklist to include the target executable;
- and
- provide the whitelist and the blacklist to the programmable device.
10 more elements
At least one machine readable medium comprising instructions which, when executed, cause at least one processor to at least:
- process a reputation associated with a target executable, the reputation determined by:
- removing a startup item associated with the target executable from a programmable device;
- determining whether the startup item is restored to the programmable device within a time period after the removal;
- when the startup item is determined to be restored to the programmable device within the time period, setting the reputation of the target executable to a negative reputation;
- and
- when the startup item is determined to not be restored within the time period, setting the reputation of the target executable to a positive reputation;
- when the reputation of the target executable is a positive reputation, update a whitelist to include the target executable;
- when the reputation of the target executable is a negative reputation, update a blacklist to include the target executable;
- and
- provide the whitelist and the blacklist to the programmable device.
7 more elements
A method comprising:
- processing, by executing an instruction using at least one processor, a reputation associated with a target executable, the reputation determined by:
- removing a startup item associated with the target executable from a programmable device;
- determining whether the startup item is restored to the programmable device within a time period after the removal;
- when the startup item is determined to be restored to the programmable device within the time period, setting the reputation of the target executable to a negative reputation;
- and
- when the startup item is determined to not be restored within the time period, setting the reputation of the target executable to a positive reputation;
- when the reputation of the target executable is a positive reputation, updating, by executing an instruction using the at least one processor, a whitelist to include the target executable;
- when the reputation of the target executable is a negative reputation, updating, by executing an instruction using the at least one processor, a blacklist to include the target executable;
- and
- providing, by executing an instruction using the at least one processor, the whitelist and the blacklist to the programmable device.
7 more elements
Dependencies are inferred from the claim text.