KR100762973B1 - Method and apparatus for detecting and deleting a virus code, and information storage medium storing a program thereof - Google Patents

Abstract

A method and an apparatus for detecting and deleting a virus code of a computer, and a recording medium recording a program for executing the method in the computer are provided to detect and delete even the virus code using a rootkit which can not be detected through a general application program and infects a DLL(Dynamic Link Library) or an SSDT(System Service Dispatcher Table) of a kernel mode. A driver selectively storing information only about codes required for performing system control necessary for detecting and deleting a virus code in an SSDT(System Service Dispatcher Table) of a window operating system is loaded prior to the other driver during system booting(S420). The virus code is detected and cured according as an application program which uses the loaded driver and detects and deletes the virus code(S430,S440).

Description

Method and apparatus for detecting and deleting a virus code, and information storage medium storing a program

1 is a reference diagram for explaining a process of executing a general program before a malicious program infection and a process of executing a general program when infected with a malicious code;

2 is a reference diagram for explaining a process of executing a malware detection and removal program according to an embodiment of the present invention;

3 is a block diagram of an apparatus for detecting and removing malicious codes according to an embodiment of the present invention;

4 is a flowchart illustrating a method for detecting and removing malware according to an embodiment of the present invention.

* Explanation of symbols for the main parts of the drawings

110: general program 120: DLL

130: system service execution table 140: execution function code storage unit

150: malware 210: malware detection and removal program

220: malware detection and removal driver

The present invention relates to the detection and removal of malicious code infected with a computer, and more particularly, to create a driver that records information about essential executable code necessary for control of a computer system separately from a system service execution table and to use the malware The present invention relates to a method for detecting and removing malicious code and a device thereof, and a recording medium having recorded thereon program code for executing the method on a computer.

In general, malicious codes are illegally installed on a user's computer and used for commercial purposes. They include various pop-up advertisements, hijacking keyword / URL (Uniform Resource Locator), compulsory start page, and sending spam mail through the user's computer. It refers to a program that harms users by performing various illegal activities. On the other hand, adware, unlike malicious code, refers to a program that installs an advertisement program on a user's computer and transmits various advertisements irrespective of the user's intention, thereby affecting the user system or restricting user rights.

Rootkits are also a collection of tools for planting backdoors or Trojan horses or hiding traces of chips after they have been inserted into the system. Therefore, the malicious code detected and removed in the present invention includes not only malicious code in its original meaning, but also adware and rootkits.

Meanwhile, when a computer boots, a kernel is first loaded into memory, and then various drivers and application programs are loaded. The kernel is the most important core of the operating system, providing several basic services to all other parts of the operating system. In general, the kernel has an interrupt handler that handles all requests that competitively require the services of the kernel, such as terminated I / O operations, a scheduler that determines which programs share the kernel's processing time, and in what order. After that, it actually includes a supervisor that gives each process a license to the computer.

The kernel also has a memory manager that manages the operating system's address space in memory or storage and distributes it to all peripherals and other users of the kernel's services. Kernel services are requested through other parts of the operating system, or through a series of programmatic interfaces, commonly known as system calls. The mode accessed and executed at the kernel level is called kernel mode, and the mode in which user applications are executed, such as applications, is called user mode.

A typical application loads a number of DLLs (Dynamic Link Library) needed to execute the program. The DLL refers to the System Service Dispatcher Table (SSDT) accessed in kernel mode, and the code of the actual execution functions is loaded. Find the recorded location and perform the desired function.

Therefore, when the above-mentioned malicious code infects such DLL or system service execution table, even if the malware detection program is executed, it hides the storage location of the malicious code or shows the distorted result to the general malware detection program. As a result, it is very difficult to identify, stop, and remove the presence of malicious code.

Accordingly, the technical problem to be achieved by the present invention is to provide information on the necessary execution code necessary for controlling the computer system separately from the system service execution table in order to detect and remove malicious codes infecting the DLL or the system service execution table (SSDT). It provides a method of detecting and removing malicious code that detects and removes malicious code by using a driver that records and uses the device, and a recording medium that records the device and program code for executing the method on a computer.

According to an aspect of the present invention, there is provided a method including loading a driver having a table in which information about code for performing system control for malware detection and removal is recorded before other drivers at system booting; And detecting and treating the malicious code by executing an application for detecting and removing the malware using the loaded driver.

Preferably, the driver selectively stores only information about a code necessary to perform system control in the system service dispatch table (SSDT) of the Windows operating system.

The code required to perform the system control preferably includes a function for performing disk reads and writes, a function for performing registry reads and writes, or a function for managing and controlling an executable program.

On the other hand, according to another field of the present invention, the technical problem has a table that records information on the code for performing the system control necessary for malicious code detection and removal, and the malicious code that is loaded before other drivers at system boot Detection and removal drivers; And a program execution unit that executes an application for detecting and removing malicious codes for detecting and treating malicious codes using the loaded malicious code-related driver.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a reference diagram for explaining a process of executing a general program before a malicious program infection and a process of executing a general program when infected with a malicious code.

The general application programs 110 running in the user mode are executed by connecting DLLs 120, which are program modules that implement various functions required for the execution. Malware detection and removal programs that normally run in user mode use the same kernel mode libraries as DLLs.

If a program service is required to access a system service such as reading or writing a disk or managing or controlling a running program, the storage unit 140 stores the actual function code for executing the function. You need to know where the code is stored. The system service execution table (SSDT) 130 records a storage location where such actual function code is stored.

That is, when the general program 110 is described in more detail, the general program 110 is executed while the DLL 120 of the module associated with it is connected and executed together, and the DLL 120 executes such a function. Reference is made to the System Service Execution Table (SSDT) 130 to find out where the basic actual functions needed to do so are recorded in the execution function code storage 140.

Meanwhile, the malicious code 150 attempts to infect the system in various ways during the execution of the general program 110. For example, it may be disguised as a number of DLLs 120 necessary for execution of the general program 110 and attached to the general program, and among the various DLLs 120, in particular, the addresses of main functions in NTDLL.DLL, a module required for system control. Intercepts the code of the malicious code itself to be executed or hides the existence of the malicious code, and modifies the value stored in the System Service Execution Table (SSDT) 130 to prevent the malware itself from executing before the original purpose code is executed. Running or hiding the presence of malware.

When malware is infected in this way, the malicious program may be executed without the user's knowledge during the execution of the general program 110, and the malware may be manipulated by manipulating information required for system control such as the system service execution table (SSDT) 130. Rootkits can also be used to hide the fact that they are currently being implemented or to hide the location of malicious code. Therefore, when trying to find the existence of malicious code using Windows Explorer or other programs, the existence of the malicious code is hidden by the DLL 120 or the system service execution table (SSDT) 130 that is already infected and manipulated according to the intention of the malicious code. Results are provided to the user.

2 is a reference diagram for explaining a process of executing a malicious code detection and removal program according to an embodiment of the present invention.

Unlike general programs, the malware detection and removal program 210 of the present invention does not find out the location where the code of the actual execution function is stored by referring to the system service execution table 130, but the system service execution table 130. With reference to the malware detection and removal driver 220, which is made separately, the location of the actual execution function code is stored. Therefore, even if the malicious code 150 infects the DLL 120 or the system service execution table 130, the exact location where the code 140 of the execution function is stored can be determined.

These drivers 220 are loaded before other drivers at boot of the operating system to get the address of the execution function of the main service of the system. Therefore, since it is loaded before other system drivers infected with malicious code and secures the address where the codes of actual functions are stored, system related functions can be executed directly without referring to the value of the system service execution table (SSDT). On the other hand, when the driver 220 is loaded after booting due to external factors, an execution function address prepared in advance for each OS and version is used. That is, in the present invention, since a separate driver 220 is referred to without referring to an infected DLL or a system service execution table (SSDT), malicious code can be directly detected.

When the driver 220 arranges the process of obtaining the execution function address of the system main service, when the driver 220 is loaded before other drivers when the operating system is booted, the system is loaded before other drivers and is not yet infected. Obtain by referring to service execution table (SSDT). On the other hand, when the drive server 220 is loaded after the boot of the operating system uses a known execution function address according to the system operating system and version information. In other words, the execution function address can be secured in advance by using the fact that the execution function address is almost the same for the same version of the operating system.

3 is a block diagram of an apparatus for detecting and removing malicious codes according to an embodiment of the present invention.

The malware detection and removal apparatus includes a malware detection and removal driver 220 and a program execution unit 300. As described above, the malware detection and removal driver 220 has a table in which information on code for performing system control for malware detection and removal is recorded, and is loaded before other drivers at system boot. In other words, the malware detection and removal driver 220 selectively stores only information about a code necessary to perform system control in the system service dispatch table (SSDT) of the Windows operating system. Examples of such code include functions for performing disk reads and writes, functions for performing registry reads and writes, or functions for managing and controlling executable programs.

The program execution unit 300 executes an application for detecting and removing malicious codes that detects and treats malicious codes using the malware-related driver 220 loaded as described above.

The program execution unit 300 includes a malware detection unit 310, a driver loading unit 320, and a malicious code removal unit 330. The malicious code detection unit 310 refers to the malicious code information DB 340 and finds malicious codes infected with a memory or a storage device of the system. To this end, the driver loading unit 320 loads the malware detection and removal driver 220 before other drivers. The malicious code removal unit 330 removes the malicious code detected by the malicious code detection unit 310. Malware removal is performed by malware detection and removal drivers, and various malware removal algorithms can be used. Meanwhile, the malicious code information DB 340 stores data related to the malware found so far and may be updated from time to time.

4 is a flowchart illustrating a method for detecting and removing malware according to an embodiment of the present invention.

First, prepare a driver that records information on code for performing system control necessary for malware detection and removal (S410). The driver loads the driver before other drivers at system boot (S420). On the other hand, the driver selectively stores only the information about the code necessary to perform system control in the system service dispatch table (SSDT) of the Windows operating system. Next, by executing an application for detecting and removing malware using the loaded driver (S430), the malware is detected and cured (S440).

On the other hand, malicious code detection and removal method can be written by a computer program. Codes and code segments constituting the program can be easily inferred by a computer programmer in the art. In addition, the program is stored in a computer readable media, and read and executed by a computer to implement a method for detecting and removing malware. The information storage medium includes a magnetic recording medium, an optical recording medium, and a carrier wave medium.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

As described above, according to the present invention, a DLL or a kernel mode system service execution table (SSDT) can be infected to detect and remove malicious code using a rootkit that cannot be detected by a general application program.

Claims (9)

delete Loading a driver that selectively stores only information on a code required to perform system control for malware detection and removal in a system service dispatch table (SSDT) of a Windows operating system before other drivers at system boot time; And The malware detection and removal method comprising the step of detecting and treating malware by executing a malware detection and removal application using the loaded driver. The method of claim 2, The code necessary to perform the system control includes a function for performing disk read and write, a function for performing registry read and write, or a function for managing and controlling an executing program. The method according to claim 2 or 3, And information about a code necessary to perform the system control is information about a location where the code is recorded. delete In the system service dispatch table (SSDT) of the Windows operating system, it selectively stores only the information on the code needed to perform system control for malware detection and removal, and it detects and removes malwares that are loaded before other drivers at system boot time. ; And And a program execution unit that executes an application for detecting and removing malicious codes for detecting and treating malicious codes using the loaded malware related driver. The method of claim 6, The code necessary to perform the system control includes a function for performing disk read and write, a function for performing registry read and write, or a function for managing and controlling an executing program. The method according to claim 6 or 7, And information about a code required to perform the system control is information about a location where the code is recorded. Loading a driver that selectively stores only information on a code required to perform system control for malware detection and removal in a system service dispatch table (SSDT) of a Windows operating system before other drivers at system boot time; And By executing a malicious code detection and removal application using the loaded driver to detect and remove the malicious code to a computer recording a program for executing the malware detection and removal method, characterized in that the computer Readable record carrier.

Images