RU2363045C1 - Method and system for removing malicious software which inhibit treatment - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: invention relates to antivirus methods and, more specifically, to treatment of computers from malicious software which inhibit treatment. The system, method and machine-readable medium for removing malicious software from a computer, with several copies of the same activated malicious software, where several copies control presence of others, include (a) detection of presence malicious software on a computer; (b) blocking any actions, which allow one activated copy of malicious software to activate another copy; (c) removal from read-only memory of a file containing executable code of the malicious software; and (d) rebooting the computer. Actions include prevention of recording on read-only memory, prevention of recording in the registry and/or blocking activation of new processes. Blocking uses a driver, loaded in the kernel area. Signature identification can be used for detecting malicious software.

EFFECT: removal of malicious software which inhibit treatment.

12 cl, 11 dwg

Description

Technical field

The present invention relates to antivirus methods and, more specifically, to the treatment of computers from malware that interferes with treatment.

State of the art

Today, there are many different types of computer malware that pose a serious threat to computers and computer networks. These malicious programs can infect a computer and can be spread by various mechanisms, such as e-mail, Internet chat, instant messenger, etc., thus quickly infecting other computers. Malicious programs can vary in their behavior from relatively harmless (for example, occasionally displaying unpleasant messages to the user) to malicious and catastrophic ones, including the complete destruction of data on the hard drive, which leads to data loss and the possible need to completely restore the operating system and application data from a backup .

Today, there are a number of common mechanisms for identifying and treating malware. These mechanisms are described, for example, in CN 1525333, US 2005/0091538, US 2005/0120238, US 5613002, WO 2004/090733, as well as other sources. These mechanisms mainly use signature-based identification of malware and removal of malware code from RAM, as well as the removal of executable files infected with malware from the hard drive. For a lot of malware, this is enough.

A relatively recent development in malware writing is the growing professionalism of malware writers. Since the advent of computers connected to the network, and until the beginning of 2000, a lot of malware was written by teenagers and university students, often as a joke. Other malware was written by adult hackers, who still rarely pursued commercial goals. Currently, this situation has changed dramatically. Although there are still many malicious programs created by laymen or as a joke, a new category of malware authors has emerged - these are highly qualified and trained programmers who use vulnerabilities in the security of the operating system and network protocols in order to benefit.

In addition, a whole class of malware has appeared to spread other types of malware, for example, the use of malicious programs to zombie computers for use as a source of spam and phishing, the use of malware methods to steal personal data, etc.

When a new version of a malicious program is distributed, it can take from several minutes to several hours for the databases of most of the major suppliers of anti-virus programs to be updated and these changes spread to their users. Professional malware authors subscribe to databases of anti-virus programs and services and as soon as they see that their malware has been detected, they immediately release a new version. This essentially reinforces the “arms race” between the antivirus software vendor and malware authors.

Another recent process related to the growing professionalism of writing malware is the desire of malware authors to write code that is very difficult to cure. Previously, malware creators did not care much about this aspect, since for many non-professional malware authors it was more important to spread malware at the highest speed and infect as many computers as possible, which was a kind of "maturity test" in the hacker community. With the commercialization of malware writing, the goals have also changed - professional malware authors often go for large chunks of code to ensure that malware written by them is not easy to cure and delete.

Thus, today there is a category of malware that is specifically designed to prevent treatment. These anti-cure malware programs usually create many of their own copies on the same computer, which are executed simultaneously using different threads. Thus, in this scheme, a malicious program may have one copy of its code that infected Internet Explorer (runs in one thread), and may have another copy of its code that infected a mail client (runs in another thread and loaded in different parts of RAM computer). When antivirus software detects one of the copies of the malware (for example, a copy of the malware that infected Internet Explorer), the antivirus software removes that copy of the malware and deletes a copy of the executable that contains the malware code.

However, this is not enough for malicious programs that prevent the cure - another copy of the malicious program (in this case, the copy that infected the mail client) determines that the first copy is deleted, and immediately copies itself to the part of the RAM in which it is loaded Internet Explorer by re-infecting Internet Explorer and re-launching the stream of the first copy of the malware. When anti-virus software encounters a second copy (the copy that infected the mail client), it happens exactly the opposite - the anti-virus software removes malicious code from the mail client in the part of RAM and deletes a copy of the executable file, however, the thread that executes the copy of the malware in Internet Explorer, immediately detects this and re-infects the email client. This phenomenon is familiar to many people who have recently become victims of such anti-cure malware, as well as to ordinary users, for whom the effect is manifested in the fact that the time a user tries to “kill” a malicious program, it reappears after some time.

Consider, for example, a situation where a computer is infected with a malicious program and the malicious code (the contents of the executable file of the malicious program) is loaded into RAM, and the corresponding key to start the file is included in the registry. Consider the situation shown in figure 1. Figure 1 shows two malicious processes, such as malware, designated as MP1 and MP2. When antivirus software kills malicious process 2, malicious process 1 restores the file from its own backup or from memory. Then, malicious process 1 is restarted. Next, the anti-virus software finds a registry key that identifies the malicious file corresponding to malicious process 1 and deletes this registry key. However, the malware again restores the registry key from its backup copy or from memory. The antivirus software then finds the malicious process 2 and kills it. However, malicious process 1 instantly restarts malicious process 2. Antivirus software then finds malicious process 1 and kills it, but malicious process 2 then restarts malicious process 1.

As a result, the antivirus program finishes scanning the system being sure that the malware has been deleted, however, as is clear from Fig. 1, the malware remains active, thus defeating the antivirus software.

Accordingly, there is a need in the prior art, in a system and method for treating computers from malware that interferes with treatment.

SUMMARY OF THE INVENTION

Accordingly, the technical result of the claimed invention is the provision of treatment for malicious programs that impede treatment.

According to a method for treating a malicious program on a computer having multiple copies of the same activated malicious program, the multiple copies controlling the existence of each of them, the method comprises the steps of: (a) identifying the presence of the malicious program in the computer; (b) then block any actions that allow one active copy of the malware to activate other copies of the malware; (c) after which the file containing the executable code of the malicious program is deleted from the permanent storage device; (d) restart the computer.

In a private embodiment, said actions include writing to the read only memory.

In another private embodiment, said actions include locking records in the system registry.

In another of the private options mentioned actions include blocking the activation of a new process. In this case, the blocking stage uses a driver loaded into the kernel area.

In yet another particular embodiment, the identification step uses signature identification to determine the malware.

A malware treatment system on a computer that has multiple copies of the same activated malware, while multiple copies control the existence of each of them, the system contains: (a) a malware detection module to identify the presence of a malicious program; (b) means installed in the area of the kernel that, after malware has been identified by the malware detection module, blocks actions that allow one active copy of the malware to activate another copy of the malware; (c) means for removing from a read-only memory device a file containing executable code of a malicious program after the blocking means has blocked said actions; and (d) means for restarting the computer, which restarts the computer after said removal tool has deleted the file containing the executable code of the malicious program.

In a private embodiment, said locking means is for locking records to read-only memory.

In another private embodiment, said locking means is for locking records in the system registry.

In yet another private embodiment, said blocking means is intended to block activation of new processes. Moreover, said malware detection module uses signature-based identification to identify malware.

A machine-readable medium for analyzing suspicious objects for malware and having a computer-executable program that executes the following steps: (a) identify the presence of a malicious program; (b) then block any actions that allow one active copy of the malware to activate another copy of the malware; (c) after which the file containing the executable code of the malicious program is deleted from the permanent storage device; (d) restart the computer.

Additional features and advantages of the invention will be established from the description that follows, and in part will be apparent from the description, and may be obtained from the practical application of the invention. The advantages of the invention will be achieved and acquired through a structure specifically emphasized in the written description and claims, as well as in the accompanying drawings.

It is understood that the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide an explanation of the claimed invention.

Brief Description of the Drawings

The accompanying drawings, which are included to provide an additional understanding of the invention and are included in and form part of this description, show embodiments of the invention and together with the description serve to explain the principles of the invention.

Figure 1 shows the results of the treatment of a malicious program using conventional algorithms.

Figure 2 shows a malware treatment algorithm in accordance with one embodiment of the present invention.

Figa shows the results of the treatment of a malicious program in accordance with one of the embodiments of the present invention.

Fig. 3b shows one possible configuration of a system that embodies the present invention.

Figure 4 shows in the form of a block diagram the relationship between the anti-cure malware and various system components.

5 shows an anti-virus driver added to an operating system in accordance with one embodiment of the invention.

Figures 6a and 6c show treatment timelines for malware with and without the present invention.

Fig.7 shows the treatment of malicious code that has been included in the list of processes of system services.

Fig. 8 shows a malware treatment process using a DLL library added to system services and user processes.

9 schematically shows a computer system in which malware can be treated in accordance with one embodiment of the invention.

Detailed disclosure of preferred embodiments

Reference will now be made to preferred embodiments of the present invention, examples which are shown in the accompanying drawings.

There are many ways for processes and threads to determine if another copy is running. For example, a malicious process can create a global object and periodically check its existence. Therefore, such a global object is used to synchronize between different copies of the same malware process. Files displayed in memory are another mechanism that can use different copies of the same malware to maintain awareness that another process has been “killed”. Opening a window is another variant of this scheme, for example, when the window is a hidden window or one of those that has all the attributes of the window except that it is not displayed on the monitor. In general, modern operating systems contain various mechanisms that allow many copies of a malicious program to maintain awareness of whether another copy has been killed, whereby they find out whether other processes need to be restarted.

Treatment software that temporarily blocks malware code from recovering a “killed” copy of itself may include blocking entries in the system registry, blocking writes to the hard disk, blocking any attempts to modify files on the hard disk, blocking attempts to start new processes or threads, etc. It should be noted that while such blocking has an effect, “useful” processes (from the user's point of view) are also not allowed to do the same things, however, in a normal situation, an antivirus program would notify the user that “treatment requires a reboot of the system”. Although it is theoretically possible that there is no need to reboot, the risk of saving the malware without rebooting the system is relatively high, as there is no guarantee that the malware code has been completely removed from the RAM, which is extremely difficult, especially when the malicious code itself is embedded in system processes or services such as Internet Explorer, ServiceHost, etc.

The processes discussed above, such as writing to the system registry, writing to the hard disk, starting new processes and threads, etc., can be blocked at the system level using a special driver or in another suitable way. In this case, if the malware tries to restore another copy of itself, this attempt is simply blocked.

As discussed previously, there is a need for a prior art in a system and method for the ability to handle malware that is specifically designed to interfere with treatment. The treatment process for such malware is shown in FIG. As shown in FIG. 2, the computer’s operating system is first scanned and malware detected (step 210) using any known method for detecting malware. The most common malware detection method of this type is the signature method described, for example, in published applications US 2006/0107055, US 2006/0143713, US 2006/0064755, US 2005/0229254 and US patent 5765030. Various commercial software products are also available that They use a signature method for detecting malicious programs, such as those from Norton / Symantec, Kaspersky Lab, McAfee, Dr. Solomon, etc. As will be apparent to one skilled in the art, the present invention is not limited to any particular malware detection method.

As soon as a file that has been infected has been identified (step 220), any actions that may interfere with the treatment are blocked before the deletion / isolation and treatment of this file begins (step 230). For example, writing to registry branches may be blocked, the launch of new processes and threads, the creation of a new file and / or file modification, etc. may be blocked. As will be understood by a person skilled in the art, this list is not necessarily exhaustive and depends on the system configuration and processor characteristics, other actions may also be blocked if necessary.

Once these actions are blocked, the malware can be treated. This treatment can be performed by any mechanisms known from the prior art, for example, by deleting the corresponding registry keys, deleting the file from the hard disk, deleting malicious code from the RAM, etc. Once this is done, then the operating system restarts (step 240). Rebooting the OS ensures that the virus code is no longer in memory.

Next, the proposed malware treatment process will be discussed in more detail, as shown in FIG. 3a. Consider a situation where the system has an infected file and the corresponding registry key for this file. The file tries to perform two processes: the first process is restoring the deleted file from the backup, the second process is restoring the key in the registry. As discussed above, first using an antivirus program, they scan the operating system to detect the presence of malware. Such a scan, as noted above, can be performed using any known methods.

As a result of a system scan, a malicious file is detected. Any actions that may interfere with the treatment process are immediately blocked. Then, the infected malicious file is disinfected or deleted from the operating system.

The second process (thread) of the malicious program, after the file has been deleted, tries to restore the file (see MP1). But in this case, he is not able to do this, because actions such as creating a new file or writing to disk are blocked.

Then the anti-virus software finds the registry key that corresponds to the infected file and removes it from the registry. Process 1 (MP1) of the malicious program again tries to recover this key, however, it cannot do this because the system is blocked from performing such actions, including (in this case) writing to the registry branches.

The antivirus software then finds the malware process 2 (MP2) and identifies it as infected. As a result, antivirus software kills this process. After this, the process (MP1) tries to restart, but due to the fact that the start of new processes is blocked, this process cannot restart. Antivirus software then kills process 1.

Antivirus software completes the scan of the system and, after the step performed above and as shown in figa, the malicious program is really removed from the system.

Fig. 3b shows one possible configuration of a system that embodies the present invention. As shown in FIG. 3c, the system includes means (310) for detecting the presence of a malicious program, which may, as previously discussed, be any of the known means for detecting malware. The system also includes means (320) for blocking certain actions that may interfere with effective treatment, and means (330) for treatment, such as means for rebooting the operating system from a reliable copy.

In the system of FIG. 3b, malware detection tool 310 first detects the presence of malware. If an infected file is detected, the tool 310 then launches the lock tool 320. The blocker 320 then blocks actions that may interfere with the cure of the malware. This may include, as noted earlier, blocking any attempts to write to the registry keys, blocking the start of new processes and threads, blocking the creation of new files and modifying existing files, etc. As soon as these processes are blocked, the tool 330 then carries out treatment, which includes the removal, quarantine or disinfection of the infected file, as is known from the prior art. Also, the tool 330 then restarts the operating system, thereby ensuring that the malware is removed from the system.

It should also be noted that elements 310, 320, and 330 may be executed by hardware, software, firmware, or any other means in which computer-executable operations and programs may be embodied and may be stored, for example, on computer-readable media.

Figure 4 shows a block diagram of the relationship between the anti-cure malware and various system components. As shown in FIG. 4, in computer random access memory (RAM) there are several processes 401 running in the user area and a number of system services 402 running in the kernel area. Hard drive 405 and registry 406 are available for use by system drivers 404. Antivirus software 403 also runs in the system area.

As shown in FIG. 4, a malicious program downloads a copy of its code into one of the system services 402. A malicious program that prevents the cure also downloads a copy of the executable file to memory for use by system services 402, as well as a copy of the registry key. Trying to remove malicious code from memory is very difficult, if not impossible, because Attempting to modify the system services code can often lead to a malfunction or malfunction of the computer.

5 shows one embodiment of the invention where an anti-virus driver 504 is added between the system driver 405 and user processes 401 and system services 402, so that any attempt to write to the system registry 406 or hard disk 405 is stopped and blocked. Therefore, the driver 504 prevents recovery one copy of the malicious program to another copy of itself or copying the executable file and registry keys to the hard drive and to the system registry.

Fig. 6a shows a situation where conventional anti-virus methods are used to attempt to cure a malware that impedes treatment. As shown in FIG. 6a, a malicious file is identified and deleted at time 2, however, at time 3, the malicious program copies the executable file from RAM (see FIGS. 4 and 5) to the hard disk at time 3. At time 4, a malicious program is detected in the system registry and the keys are deleted, but at time 5, the malicious program recovers the keys from memory. Thus, when the computer reboots at time 7, at time 8, the malicious program is still present in memory, on the hard disk and in the registry.

Fig. 6b shows a scenario where driver 204 is used to block malware attempts to prevent cure. As shown in FIG. 6c, after detecting and deleting a file containing malware at time 2, the malware attempt to create another copy of the file on the hard disk at time 3 is blocked. At time 4, the malware key is deleted from the system registry. At time 5, an attempt to write another copy of the key to the system registry is blocked. Thus, after rebooting at time 7, the system is cleared of malware.

Another example of an anti-cure malware is malware that is embedded in the code of one of the system services 730, as shown in FIG. 7. Such a malware program cannot be cured by conventional means without a computer system crash. Thus, the method described here can also be used to treat such malware. In this case, the malicious program is removed from the disk, and the operating system is loaded from a reliable image, as previously discussed with reference to examples.

Although the discussion above implied using a driver to block any malware attempts to resist treatment, this is not the only mechanism for solving this problem. Another option is to use a dynamically loaded library (DLL) (see 832 in FIG. 8), which acts in a similar way to the driver at the system level. As another option, additional software can be introduced into the infected process, which will work according to the scheme described above - to block any attempt by malicious code to copy itself or to infect the computer again before it reboots. In the future, this option for blocking any attempt by a malicious program to infect a computer again may be implemented both at the technical level and at the software level.

For example, FIG. 9 shows a computer system in which the present invention may be embodied. A computer system includes one or more processors, such as a processor 21. The processor 21 is connected to a communications infrastructure 23, such as a bus or network. Various software embodiments are described in terms of this exemplary computer system. After reading the description, it will become apparent to a person skilled in the art how to implement the invention using other computer systems and / or computer architectures.

The computer system also includes system memory 22, which is divided into read-only memory (ROM) 24 and random access memory (RAM) 25. ROM 24 includes BIOS 26. RAM 25 can store parts of the operating system 35, file system 36 , application code 37, as well as other program modules 37 and program data 39. The system memory itself is connected, like the processor, to the system bus 23.

In addition to the processor and system memory, other devices can be connected to the system bus, such as video adapter 48, host adapter 55, interfaces of hard disk 32, magnetic disk 33, optical disk 34, serial port 46, and network interface 53. Video adapter 48 connected to the monitor 47, is able to display information on its display. The host adapter 55 allows you to transfer data between the system bus 23 and the data storage 57. The hard disk interface provides access to the hard disk, which can store the operating system 35, applications 37, as well as other program modules 37 and program data 39. To the serial interface port 46, you can connect various external devices, such as a mouse 42, a keyboard 40, as well as a modem 54. Using a modem 54, as well as using a network interface 53, you can access the remote computer 49, as well as applications 37, which are there tanovleny.

Having the preferred embodiments described above, it will be apparent to those skilled in the art that the specific advantages of the described method and apparatus will be achieved. It will also be appreciated that various modifications, adaptations, and alternative embodiments may be made within the scope and spirit of the present invention. In addition, the invention is defined by the following claims.

Claims (12)

1. A method of treating a malicious program in a computer having multiple copies of the same activated malicious program, wherein multiple copies control the existence of each of them, the method comprising the steps of:
(a) identify the presence of malware on the computer;
(b) then block any actions that allow one active copy of the malware to activate another copy of the malware;
(c) after which the malicious program code and links to it are deleted from the permanent storage device;
(d) restart the computer. 2. The method according to claim 1, in which said actions include locking write to read-only memory. 3. The method according to claim 1, in which said actions include locking records in the system registry. 4. The method according to claim 1, in which the aforementioned actions include blocking the start of new processes. 5. The method according to claim 1, wherein the blocking step uses a driver loaded into the kernel area. 6. The method according to claim 1, wherein the identification step uses signature identification to detect malware. 7. The malware treatment system in a computer that has many copies of the same activated malware, while many copies control the existence of each of them, while the system contains:
(a) a malware detection module for identifying malware;
(b) means installed in the kernel area, which, after the malware has been identified by the malware detection module, blocks actions that allow one active copy of the malware to activate another copy of the malware;
(c) means for removing malware code and links to it from the permanent storage device after the blocking means has blocked said actions; and
(d) means for restarting the computer, which restarts the computer after said removal tool has deleted the file containing the executable code of the malicious program. 8. The system according to claim 7, in which the said locking means is designed to lock records in read-only memory. 9. The system according to claim 7, in which the said means of blocking is designed to block recording in the system registry. 10. The system according to claim 7, in which the said means of blocking is designed to block the launch of new processes. 11. The system of claim 7, wherein said malware detection module uses signature identification to identify malware. 12. A machine-readable medium for analyzing suspicious objects for malicious programs and having a computer-executable program that, when executed, performs the following steps:
(a) identify the presence of malware;
(b) then block any actions that allow one active copy of the malware to activate another copy of the malware;
(c) after which the malicious program code and links to it are deleted from the permanent storage device; and
(d) restart the computer.

Images