Bitdefender Ipr Management Ltd.

Prevx Limited

Mihai Chiriac

Teodor Stoenescu

Dumitru Codreanu

Mihai Neagu

According to one aspect, a dynamic binary instrumentation (DBI) framework is used to identify rootkits and disable their malicious functionality. A user-mode or kernel-mode anti-rootkit (ARK) engine monitors the execution of a program running on a host machine in user more or kernel mode. Upon encountering calls to certain functions that may be used by rootkits to subvert system functionality (e.g. system calls used to manage the system registry, storage/disk, processes/threads, and/or network communications), the anti-rootkit engine executes translated versions of the functions in an isolated environment and continues execution of the program under analysis using the results of the translated code execution. The translated code execution replaces the execution of original code which may or may not have been subverted by a rootkit. Isolating the stack and registers of the isolated environment impedes detection of the monitoring process by rootkits.

Anti-rootkit systems and methods

In some embodiments, a malware detecting system is configured to conduct an iterative, collaborative scan of a target object (computer file or process), comprising a server-side scan and a client-side scan, and to assess the malware status of the target object according to the results of the client-side and server-side scans. The client-side scan comprises computationally-intensive operations such as virtual-environment emulation, decryption and data compression methods, while the server-side scan comprises database-intensive operations such as hash lookups. The information exchanged between client and server systems may be limited to relatively-compact data, such as hashes, which may amount to a few bytes per target object. Exemplary methods and systems described herein allow storing malware signature databases on the server side, thus reducing the burden of frequently delivering data-heavy signature updates to large numbers of customers, without requiring the server side to perform computationally-intensive scanning tasks for large numbers of customers.

Collaborative malware scanning

In one aspect, an executable computer file is partitioned into basic blocks of code. At least some basic blocks are translated into translated basic blocks. At least some translated basic blocks are linked in memory of a computer. At least some translated basic blocks on the computer are executed so as to enable the file to be unpacked or decrypted. In this way, the file can be analyzed to determine whether the file is or should be classed as malware. In another aspect, at least a read page of cache memory is created for at least some basic blocks and at least a write page of cache memory is created for at least some basic blocks. During the execution of a basic block, at least one of the read page and the write page is checked for a cached real address corresponding to the virtual address that is being accessed for said basic block.

Growing community of inventors

Bucharest, Romania

Mihai Chiriac