Generic disinfection of programs infected with a computer virus
November 21, 2014. Estimated Expiration Date is calculated based on simple USPTO term provisions. It does not account for terminal disclaimers, term adjustments, failure to pay maintenance fees, or other factors which might affect the term of a patent.Patent ReferencesMethod and apparatus for verifying the integrity of a file stored separately from a computer Method for recovery of a computer program infected by a computer virus Data processing virus protection circuitry including a permanent memory for storing a redundant partition table Method for recovery of a computer program infected by a computer virus Searching for patterns in encrypted data Method and apparatus for increasing the speed of the detecting of computer viruses Method and arrangement for monitoring computer manipulations Automatic analysis of a computer virus structure and means of attachment to its hosts Patent #: 5485575 InventorsApplicationNo. 342520 filed on 11/21/1994US Classes:713/188, COMPUTER VIRUS DETECTION BY CRYPTOGRAPHY714/36, Test sequence at power-up or initialization714/38, Of computer software714/39Monitor recognizes sequence of events (e.g., protocol or logic state analyzer)ExaminersPrimary: Tarcza, Thomas H.Assistant: Sayadian, Hrayr A. Attorney, Agent or FirmInternational ClassesH04L 009/00H04K 001/00 AbstractA method for restoring a computer program infected with a computer virus to its non-viral condition. The method uses certain information about an uninfected host program recorded prior to infection without relying upon pre-existing knowledge of the computer virus. The method includes: recording a checksum of the uninfected original program, the length of the program, and information pertaining to bytes located near the beginning and end of the original program; and, subsequent to any modification of the original program that is deemed suspicious, generating one or more trial reconstructions based on the recorded information and information contained in the modified file; comparing a checksum of each generated trial reconstruction with the checksum of the original program stored in the database; and outputting a trial reconstruction as the original uninfected program if its checksum matches that of the original program.Other References
| |
