Method for detecting infection of software programs by memory re

Details Method for detecting infection of software programs by memory re Method for detecting infection of software programs by memory re

1996-04-15

1998-10-13

Beausoliel, Jr., Robert W.

39518314, 39518315, H04L 900, H04K 100

Patent

active

058225170

ABSTRACT:
A method for detecting the infection of executable computer software programs by memory resident computer software virus programs is provided. The invented method comprises comparing an initial state of an executable program to a final state of the program. If the final state of the program is different than the initial state, then the method generates an alarm signal to inform a user that the program has been modified by a virus and is infected. Particularly, as a program is called into memory, that state of the program is marked as the initial state. When execution of the program is completed, that state of the program is marked as the final state. Alternatively, at the moment when processing of the program commences, that state of the program is marked as the final state of the program. The method compares the final and initial states to determine if the two states match. If the two states are the same, then it is confirmed that the program was not modified and is not infected. If it is determined that the two states are different, then the method generates an alarm signal to inform the user that the program is infected. Additionally, if the final state does not match the initial state, a known backup and restore technique can be invoked by the method for restoring the infected program to its initial state.

REFERENCES:
patent: 5319776 (1994-06-01), Hile
patent: 5349655 (1994-09-01), Mann
patent: 5359659 (1994-10-01), Rosenthal
patent: 5398196 (1995-03-01), Chambers
patent: 5408642 (1995-04-01), Mann
patent: 5448668 (1995-09-01), Perelson et al.
patent: 5473769 (1995-12-01), Cozza
patent: 5493649 (1996-02-01), Slivka et al.
patent: 5502815 (1996-03-01), Cozza
patent: 5613002 (1997-03-01), Kephart et al.

Affiliated with

Also associated with

Rating

Method for detecting infection of software programs by memory re does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Method for detecting infection of software programs by memory re, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method for detecting infection of software programs by memory re will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-323003