Back to results
US 7,607,173 B1Granted
Method and apparatus for preventing rootkit installation
AssigneeSymantec Corporation
InventorsPeter Szor, Peter Ferrie, Matthew Conover
Life of this patent
Estimating the term…
Abstract
Call to driver load functions, including associated driver objects to be loaded, are stalled and evaluated for indications of a rootkit. When a rootkit is indicated, protective action is taken, and optionally a user or system administrator are notified. Calls not indicative of a rootkit are released and allowed to load. In one embodiment, calls to currently loaded drivers and calls related to installation of new hardware, are excluded from the evaluation for indications of a rootkit. In additional embodiments, sensitive structures and calls to sensitive structures of a computer system are also evaluated for indications of a rootkit.
Claims20
A computer implemented method comprising:
- executing computer code, stored in a memory of a computer system, on a processor of said computer system, wherein said executing prevents installing a rootkit, on said computer system, through operations at least including:
- identifying currently loaded drivers on said computer system;
- stalling a call to a driver load function, said call including an associated driver object;
- determining whether said call identifies a currently loaded driver;
- upon a determination that said call does not identify a currently loaded driver, determining whether said call is associated with a new device detection on said computer system;
- upon a determination that said call is not associated with said new device detection, determining whether said driver object is indicative of a rootkit;
- and
- upon a determination that said driver object is indicative of a rootkit, taking protective action to prevent said rootkit installation.
5 more elements
A method comprising:
- executing computer code, stored in a memory of a computer system, on a processor of said computer system, wherein said executing includes operations at least including:
- locating a service descriptor table (SDT) address pointer to a service descriptor table on said computer system, wherein said SDT address pointer is to be used as a reference service descriptor table (SDT) address pointer;
- storing a copy of said SDT address pointer as a reference SDT address pointer;
- enumerating process threads currently running on said computer system;
- locating an enumerated process thread;
- locating an enumerated process thread service descriptor table (SDT) address pointer, in a service description table field in said enumerated process thread, to a service descriptor table for said enumerated process thread;
- determining whether a rootkit is indicated in said enumerated process thread based upon a comparison of said enumerated process thread SDT address pointer and said reference SDT address pointer, wherein upon said enumerated process thread SDT address pointer and said reference SDT address pointer being different, a rootkit is indicated in said enumerated process thread by said enumerated process thread SDT address pointer;
- and
- upon a determination that said rootkit is indicated in said enumerated process thread, taking protective action to protect said computer system.
6 more elements
A computer implemented method comprising:
- executing computer code, stored in a memory of a computer system, on a processor of said computer system, wherein said executing includes operations at least including:
- stalling a call to a local descriptor table (LDT) add entry function, said call including an associated local descriptor table (LDT) entry;
- determining whether a rootkit is indicated in said associated LDT entry based upon whether an S flag in said LDT entry indicates kernel mode and whether a descriptor privilege level (DPL) indicates a user mode privilege;
- upon a determination that said S flag indicates kernel mode and said DPL indicates a user mode privilege, determining said rootkit is indicated in said associated LDT entry;
- and
- upon a determination that said rootkit is indicated in said associated LDT entry, taking protective action to protect said computer system.
3 more elements
A computer implemented method comprising:
- executing computer code, stored in a memory of a computer system, on a processor of said computer system, wherein said executing includes operations at least including:
- locating a local descriptor table (LDT) of a computer system, said local descriptor table including one or more local descriptor table (LDT) entries;
- locating an LDT entry in said LDT;
- determining whether a rootkit is indicated in said LDT entry based upon whether an S flag in said LDT entry indicates kernel mode and whether a descriptor privilege level (DPL) indicates a user mode privilege;
- upon a determination that said S flag indicates kernel mode and said DPL indicates a user mode privilege, determining said rootkit is indicated in said LDT entry;
- and
- upon a determination that said rootkit is indicated in said LDT entry, taking protective action to protect said computer system.
4 more elements
A computer implemented method comprising:
- executing computer code, stored in a memory of a computer system, on a processor of said computer system, wherein said executing includes operations at least including:
- locating a critical driver on said computer system;
- determining an allocated memory address range of said critical driver;
- locating a critical driver service dispatch routine table (SDRT) associated with said driver;
- locating a critical driver service dispatch routine table (SDRT) entry in said critical driver SDRT, said critical SDRT entry including a critical driver SDRT entry routine address pointer;
- determining whether a rootkit is indicated in said critical driver SDRT entry based upon whether said critical driver SDRT entry routine address pointer is within said allocated memory address range;
- upon a determination that said critical driver SDRT entry routine address pointer is not within said allocated memory address range, determining said rootkit is indicated is indicated in said critical driver SDRT entry;
- and
- upon a determination that said rootkit is indicated in said critical driver SDRT entry, taking protective action to protect said computer system.
6 more elements
Dependencies are inferred from the claim text.