Patent Application
20090217378
In one sense, malware includes unwanted software that is installed on a computer. Malware may be hostile, intrusive, or annoying. It may be designed to infiltrate or damage a computer system without the owner's informed consent. Malware can be relatively benign or severely disruptive. Some malware can spread from computer to computer via networks or the use of removable computer-readable media. Some malware attempts to remain hidden from user inspection while other malware becomes obvious immediately.
The number of malware continues to grow at a phenomenal rate. Vendors that produce malware detection and removal products are continually updating the list of malware their products can detect and remove. Guarding against malware is an ongoing challenge.
Briefly, aspects of the subject matter described herein relate to removing malware from a computer system. In aspects, an anti-malware engine detects malware and writes a tool onto a storage device. The anti-malware engine disguises the tool to make it more difficult for malware to detect that the tool is on the storage device. In addition, the anti-malware engine encrypts and writes remediation actions to be taken by the tool to the storage device and requests that the computer reboot. After rebooting, the computer executes the tool which takes the remediation actions including removing the malware.
This Summary is provided to briefly identify some aspects of the subject matter that is further described below in the Detailed Description. This Summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.
The phrase “subject matter described herein” refers to subject matter described in the Detailed Description unless the context clearly indicates otherwise. The term “aspects” is to be read as “at least one aspect.” Identifying aspects of the subject matter described in the Detailed Description is not intended to identify key or essential features of the claimed subject matter.
The aspects described above and other aspects of the subject matter described herein are illustrated by way of example and not limited in the accompanying figures in which like reference numerals indicate similar elements and in which:
Aspects of the subject matter described herein are operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well known computing systems, environments, and/or configurations that may be suitable for use with aspects of the subject matter described herein include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microcontroller-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
Aspects of the subject matter described herein may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and so forth, which perform particular tasks or implement particular abstract data types. Aspects of the subject matter described herein may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
With reference to
Computer 110 typically includes a variety of computer-readable media. Computer-readable media can be any available media that can be accessed by the computer 110 and includes both volatile and nonvolatile media, and removable and non-removable media. By way of example, and not limitation, computer-readable media may comprise computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile discs (DVDs) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by the computer 110. Communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer-readable media.
The system memory 130 includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) 131 and random access memory (RAM) 132. A basic input/output system 133 (BIOS), containing the basic routines that help to transfer information between elements within computer 110, such as during start-up, is typically stored in ROM 131. RAM 132 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit 120. By way of example, and not limitation,
The computer 110 may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only,
The drives and their associated computer storage media, discussed above and illustrated in
The computer 110 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 180. The remote computer 180 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer 110, although only a memory storage device 181 has been illustrated in
When used in a LAN networking environment, the computer 110 is connected to the LAN 171 through a network interface or adapter 170. When used in a WAN networking environment, the computer 110 typically includes a modem 172 or other means for establishing communications over the WAN 173, such as the Internet. The modem 172, which may be internal or external, may be connected to the system bus 121 via the user input interface 160 or other appropriate mechanism. In a networked environment, program modules depicted relative to the computer 110, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation,
As mentioned previously, malware is a significant problem to computer systems. In one embodiment, malware may include computer viruses, worms, Trojan horses, spyware, unwanted adware, other malicious or unwanted software, and the like. In another embodiment, malware may include software that presents material that is considered to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable.
Malware is becoming increasingly difficult to remove. Malware will often inject itself into threads or other code of other running processes including critical system processes. If anti-malware software attempts to remove the malware from a critical system process, this often causes the system to stop functioning.
To deal with this “stubborn” malware, anti-malware software may attempt to remove the malware during reboot by writing the name of the malware file to remove in a well known location in a registry or other database or some other well known location and requesting a reboot of the system. Malware may monitor for this removal activity and may delete the name of the malware file prior to the system rebooting. Thus, on reboot, the malware remains installed in the system.
To address this issue and others, aspects of the subject matter described herein relate to creating a mechanism by which malware may be removed. In aspects of the subject matter described herein, after detecting malware, an anti-malware engine may take disguised actions to remove the malware from the system. These disguised actions may include writing a tool onto a hard disk using a random file name, encrypting the actions to be taken by the tool, requesting a reboot of the system, and executing the tool during reboot before the malware is able to execute.
The system 200 comprises an environment in which processes may execute. In one embodiment, the system 200 comprises a computer such as the computer 110 of
The process 205 may be a system process or other process that if killed will cause the system to crash or otherwise function incorrectly. Thus, the anti-malware product 215 may not be able to kill the process 205 to remove the malware 210 without causing adverse effects. The malware 210 may monitor for activities intended to remove the malware 210 and may attempt to protect itself against such activities.
The anti-malware product 215 includes an engine 220 that is designed to detect malware such as the malware 210. The engine 220 includes a tool 225 that is designed to remove malware when the system 200 is restarted. The engine 220 may be replaced periodically as an anti-malware vendor creates new versions of the engine 220 to deal with new malware and provides the versions to customers. Likewise, the tool 225, may be updated and changed so that if malware is designed to combat the malware removing features of the tool 225, that the tool can be changed so that the malware can no longer detect the new version of the tool 225 without the malware being redesigned.
In one embodiment, the tool 225 resides in the anti-malware product 215 and is not placed on the store 230 until after the engine 220 detects the malware 210 and begins to take remediation actions to remove the malware. After the tool 225 takes the remediation actions, it is removed from the store 230. This is done, in part, in an attempt make it more difficult for malware writers to analyze and combat the tool 225.
When the tool 225 is placed on the data store, it may be given a random name and placed in a random location in the data store. Again, this is done, in part, to make it more difficult for the malware 210 to detect that the tool 225 has been placed on the store 230 as the malware 210 may be looking for a specifically named tool in a specific directory.
In addition to the tool, the engine 220 may write a list of one or more remediation actions onto the store 230. These remediation actions are to be performed by the tool 225 when the tool 225 is executed after the system 200 is restarted. The remediation actions may include, for example, removing the malware, modifying configuration files (e.g., a system registry), and the like upon restarting the system 200. The tool 225 may be structured to avoid removing files indicated by a symbolic link (e.g., a tactic malware sometimes uses to avoid its removal).
The remediation actions may be encrypted to disguise what actions are going to be taken to what files upon restarting the system 200. The remediation actions may also be stored in a random file name and placed in a random directory to defend against malware actions to abort the remediation actions. Malware that is scanning for changes that affect it may not know that the remediation actions have been written to the store 230 and/or may not be able to decrypt the remediation actions to determine that the malware is in danger of being removed from the system 200.
In conjunction with writing the tool 225 to the store 230, the anti-malware product 215 may configure the system 200 to execute the tool 225 on the store 230 upon restarting. The anti-malware product 215 may also request that the system 200 restart in order that the tool 225 may execute and remove the malware 235 from the store 230.
The tool process 305 may be executed very early in the booting process such that it executes at a time after drivers and other kernel mode processes have been initialized but before regular user mode processes begin to execute. This may be accomplished by structuring the tool 225 such that it does not need all of the system user mode processes to be running in order for the tool process 305 to execute and then having the system execute the tool process 305 before the system 200 executes other user mode processes.
When the tool process 305 executes, it removes the malware 235 from the store 230 before the malware 235 is able to execute. As the malware 235 is unable to execute, it cannot inject itself into system processes and defend itself from removal.
The tool process 305 may also change configuration files and take other remediation actions as described previously. After the tool process 305 executes, the tool image 225 may be removed from the store 230
Although the entities illustrated in
Furthermore, in some embodiments, one or more of the entities that are illustrated as being in user or kernel mode may be distributed in both user and kernel mode such that a portion of the entity (and/or its functions) executes in kernel mode and a portion of the entity (and/or its functions) executes in user mode.
Turning to
At block 415, a random file name is obtained. For example, referring to
At block 420, malware remediation code is written to a data store using the random file name. For example, referring to
At block 425, remediation actions the remediation code is to execute are disguised. For example, referring to
At block 430, the disguised remediation actions are written to the data store. For example, referring to
At block 435, the computer is configured to execute the remediation code upon restart. For example, referring to
At block 440, a request to restart the computer is performed. For example, referring to
At block 445, the computer is restarted. For example, referring to
At block 450, the actions end.
Turning to
At block 515, the remediation tool begins executing. For example, referring to
At block 520, logging is initialized. For example, referring to
At block 525, the computer is configured to not execute the remediation tool upon subsequent restarts. For example, referring to
At block 530, one or more remediation actions are taken. For example, referring to
At block 530, the actions end.
As can be seen from the foregoing detailed description, aspects have been described related to removing malware from a computer system. While aspects of the subject matter described herein are susceptible to various modifications and alternative constructions, certain illustrated embodiments thereof are shown in the drawings and have been described above in detail. It should be understood, however, that there is no intention to limit aspects of the claimed subject matter to the specific forms disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions, and equivalents falling within the spirit and scope of various aspects of the subject matter described herein.
