Symantec Corporation

Frederic Perriot

Carey S Nachenberg

Peter Szor

Parameters of DNS transactions associated with DNS MX record queries, which may be performed by mass-mailing worms from a host computer system, are detected at a DNS proxy and collected. An outbound SMTP transaction, such as an e-mail message, received at an SMTP proxy is stalled at the SMTP proxy and a determination is made whether malicious code activity is detected on the host computer system by correlating the parameters associated with the DNS MX record queries and the e-mail message. In one embodiment, above a specified threshold rate of DNS MX record queries to resolve SMTP server IP addresses, followed by the use of a resolved SMTP server IP address to send the e-mail message, an assumption is made that the e-mail message is generated by a worm, such as a mass-mailing worm, and protective action is taken thus preventing propagation of the worm, or other malicious code, via the outbound e-mail message.

Method and apparatus to block fast-spreading computer worms that use DNS MX record queries

Methods, apparati, and computer-readable media for determining whether computer code () contains malicious code. In a method embodiment, the computer code () is optimized () to produce optimized code; and the optimized code is subject to a malicious code detection protocol. In an embodiment, the optimizing () comprises at least one of constant folding (), copy propagation (), non-obvious dead code elimination (), code motion (), peephole optimization (), abstract interpretation (), instruction specialization (), and control flow graph reduction ().

Countering polymorphic malicious computer code through code optimization

Prior to a modification of an executable computer file (), a modification analysis manager () stores () content concerning a specified number of specified sized blocks () of a specified section of the executable file (). After the modification of the executable file (), the modification analysis manager () compares (), for each block (), the content at the location of the block () after the modification of the executable file () with the content of the block () prior to the modification. The modification analysis manager () determines () the status of the modification, responsive to a result of the comparison.

Growing community of inventors

Santa Monica, CA, United States of America

Frederic Perriot