Managing process image hijacks

Abstract

In some embodiments, a method includes storing, at a first time, a copy of an executable process at a memory area if an initial thread of the executable process is defined in a suspended state such that the copy of the executable process is not executed at the memory area. The executable process can be maintained at a storage different from the memory area. The method also includes comparing, at a second time after the first time, a header of a section of the executable process with a header of a section of the copy of the executable process. The method further includes determining not to execute the executable process if the header of the section of the executable process is different from the header of the section of the copy of the executable process.

What is claimed is: 
     
         1 . A method, comprising:
 storing, at a first time, a copy of an executable process at a memory area if an initial thread of the executable process is defined in a suspended state such that the copy of the executable process is not executed at the memory area, the executable process being maintained at a storage different from the memory area;   comparing, at a second time after the first time, content of a header of a section of the executable process with content of a header of a section of the copy of the executable process; and   determining not to execute the executable process if the content of the header of the section of the executable process is different from the content of the header of the section of the copy of the executable process.   
     
     
         2 . The method of  claim 1 , further comprising:
 comparing a number of sections in the executable process with a number of sections in the copy of the executable process if the content of the header of the section of the executable process is substantially identical to the content of the header of the section of the copy of the executable process; and   determining not to execute the executable process if the number of sections in the executable process is different from the number of sections in the copy of the executable process.   
     
     
         3 . The method of  claim 2 , wherein the header of the section of the executable process is from a plurality of headers of the executable process, the header of the section of the copy of the executable process is from a plurality of headers of the copy of the executable process, the method further comprising:
 comparing content of the plurality of headers of the executable process with content of the plurality of headers of the copy of the executable process if the number of sections in the executable process is equal to the number of sections in the copy of the executable process; and   determining not to execute the executable process if the content of the plurality of headers of the executable process is different from the content of the plurality of headers of the copy of the executable process.   
     
     
         4 . The method of  claim 3 , further comprising:
 comparing content of the sections of the executable process with content of the sections of the copy of the executable process if the content of the plurality of headers of the executable process is substantially identical to the content of the plurality of headers of the copy of the executable process; and   determining not to execute the executable process if the content of the sections of the executable process is different from the content of the sections of the copy of the executable process.   
     
     
         5 . The method of  claim 1 , further comprising:
 triggering an event if the executable process is determined not to be executed.   
     
     
         6 . The method of  claim 5  wherein the event is an alarm associated with a user or an administrator. 
     
     
         7 . A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:
 duplicate an executable process maintained at a storage location to define a copy of the executable process if an initial thread of the executable process is defined in a suspended state;   store the copy of the executable process at a memory area different from the storage location such that the copy of the executable process is not executed at the memory area;   compare content of a header of the executable process with content of a header of the copy of the executable process; and   send a notification if the content of the header of the executable process is different from the content of the header of the copy of the executable process.   
     
     
         8 . The non-transitory processor-readable medium of  claim 7 , the code further comprising code to cause the processor to:
 compare a number of sections in the executable process with a number of sections in the copy of the executable process if the content of the header of the executable process is substantially identical to the content of the header of the copy of the executable process; and   send the notification if the number of sections in the executable process is different from the number of sections in the copy of the executable process.   
     
     
         9 . The non-transitory processor-readable medium of  claim 8 , wherein the header of the executable process is from a plurality of headers of the executable process, the header of the copy of the executable process is from a plurality of headers of the copy of the executable process, the code further comprising code to cause the processor to:
 compare content of the plurality of headers of the executable process with content of the plurality of headers of the copy of the executable process if the number of sections in the executable process is equal to the number of sections in the copy of the executable process; and   send the notification if the content of the plurality of headers of the executable process is different from the content of the plurality of headers of the copy of the executable process.   
     
     
         10 . The non-transitory processor-readable medium of  claim 9 , the code further comprising code to cause the processor to:
 compare content of the sections of the executable process with content of the sections of the copy of the executable process if the content of the plurality of headers of the executable process is substantially identical to the content of the plurality of headers of the copy of the executable process; and   send the notification if the content of the sections of the executable process is different from the content of the sections of the copy of the executable process.   
     
     
         11 . The non-transitory processor-readable medium of  claim 7 , the code further comprising code to cause the processor to:
 trigger an event if the notification is sent.   
     
     
         12 . The non-transitory processor-readable medium of  claim 11 , wherein the event is an alarm associated with a user or an administrator. 
     
     
         13 . The non-transitory processor-readable medium of  claim 7 , the code further comprising code to cause the processor to:
 determine not to execute the executable process if the content of the header of the executable process is different from the content of the header of the copy of the executable process.   
     
     
         14 . An apparatus, comprising:
 a first memory portion configured to store an executable process;   a second memory portion separate from the first memory portion;   a copy module operatively coupled to the first memory portion and the second memory portion, the copy module configured to store, at a first time, a copy of the executable process within the second memory portion such that the copy of the executable process is not executed at the second memory portion; and   a comparison module operatively coupled to the first memory portion and the second memory portion, the comparison module configured to compare, at a second time after the first time, a number of sections of the executable process with a number of sections of the copy of the executable process,   the comparison module configured to send a notification if the number of sections of the executable process is different from the number of sections of the copy of the executable process.   
     
     
         15 . An apparatus of  claim 14 , wherein:
 the comparison module is configured to compare, at a third time after the first time and before the second time, content of a header of the executable process with content of a header of the copy of the executable process,   the comparison module configured to compare the number of sections of the executable process with the number of sections of the copy of the executable process if the content of the header of the executable process is substantially identical to the content of the header of the copy of the executable process.   
     
     
         16 . An apparatus of  claim 14 , wherein:
 the comparison module is configured to compare, at a third time after the second time, content of a plurality of headers of the executable process with content of a plurality of headers of the copy of the executable process if the number of sections of the executable process is equal to the number of sections of the copy of the executable process,   the comparison module configured to send the notification if the content of the plurality of headers of the executable process is different from the content of the plurality of headers of the copy of the executable process.   
     
     
         17 . An apparatus of  claim 14 , wherein:
 the comparison module is configured to compare, at a third time after the second time, content of the sections of the executable process with content of the sections of the copy of the executable process if the number of sections of the executable process is equal to the number of sections of the copy of the executable process,   the comparison module configured to send the notification if the content of the sections of the executable process is different from the content of the sections of the copy of the executable process.   
     
     
         18 . An apparatus of  claim 14 , wherein the comparison module is configured to trigger an alarm associated with a user or an administrator if the number of sections of the executable process is different from the number of sections of the copy of the executable process. 
     
     
         19 . An apparatus of  claim 14 , wherein the copy module is configured to store the copy of the executable process in the second memory portion in response to an initial thread of the executable process being defined in a suspended state. 
     
     
         20 . The apparatus of  claim 14 , wherein the comparison module configured to send a signal such that the executable process is not executed at the first memory portion if the number of sections of the executable process is different from the number of sections of the copy of the executable process.