Mcafee, Inc.

Ivan Alexandrovich Teblyashkin

Igor G Muttik

Viatcheslav Peternev

Dmitry O Gryaznov

Neil Andrew Cowie

A malware scanner, for malware such as computer viruses, worms, Trojans and the like, utilizes the external call characteristics associated with known items of malware to identify the presence of malware within a computer file. Malware written in a high level language when compiled can take a variety of different forms as object code, but these different object code forms will usually share external call characteristics to a sufficient degree to allow the presence of such external call characteristics to properly and accurately generically identify different compiled variants of the source code malware.

Malware detection using external call characteristics

A system, method, and computer program product are provided for detecting malware. In use, a search is conducted for known elements of computer code. Upon the detection of at least one known element of computer code, various operations are performed. In particular, the present technique steps back in the computer code, and emulates the computer code. Such emulation and stepping are performed for detecting malware.

Emulation system, method and computer program product for malware detection by back-stepping in program code

Computer programs are analysed for the occurrence of redundant program instructions of program instruction using uninitialised variables. If the number of such instructions exceeds a threshold level, then the computer program is treated as containing a computer virus. This technique is useful in identifying new and polymorphic viruses.

Heuristic detection of polymorphic computer viruses based on redundancy in viral code

Virus fingerprint data is automatically generated for use in detecting computer viruses and virus removal data for use in removing computer viruses from infected files. The fingerprint generation technique serves to identify the infected virus carrying portions of a computer file and then search within those portions for matching blocks of bytes in excess of a certain size that are consistently located at a predetermined position within the infected computer file such that they may be used to reliably detect that computer virus when it is infecting different host computer files. The removal data generation mechanism serves to search the infected computer file against a clean version of that computer file to identify matching blocks. Critical data missing within the infected computer file may be found within the virus carrying portions by the application of various decryption techniques. Cutting points to remove the virus carrying portions are identified. The fingerprint data and the removal data are tested on pairs of clean and infected computer files to verify that they operate correctly.

Automatic builder of detection and cleaning routines for computer viruses

A system, method and computer program product are provided for detecting viruses in software. Initially, data is compared with a plurality of virus definitions in a first database. If the data is successfully compared with at least one of the virus definitions, a security event is executed. The data is then compared with fingerprints of innocent data in a second database. If the data is successfully compared to the fingerprints of innocent data, access to the data is permitted. If, however, the data is unsuccessfully compared to the virus definitions and the fingerprints of innocent data, information is transmitted over a network for analysis purposes.

Growing community of inventors

Aylesbury, United Kingdom

Ivan Alexandrovich Teblyashkin