EP0514815A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Method for recovery of a computer program infected by a virus
Assignee: Gen Digital Inc
•
Filing: 1992-05-18
•
Granted: —
•
Expires: 2012-05-18
Abstract
Abstract A recovery technique allows a computer program to be recovered from a program which has been infected with a computer virus. Prior to the program being infected, a unique fingerprint of the program is taken and stored along with data relating to the beginning portion of the program at a location separate from the program. A program thought to be infected is processed by generating a fingerprint of a string in the program utilizing the stored data. The fingerprint that is generated is compared with the stored fingerprint to determine whether or not the two fingerprints match. If the fingerprints match, the program is restored from the stored information and the string. If the fingerprints do not match, the value utilized to select the string can be incremented and the process repeated.
Inventors
- 👤 Omri Mann
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-10-28 10:17
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/565; G06F21/568; G06F11/00; G06F11/07; G06F11/14; G06F11/1402
Claims Analysis
Total Claims: 10
Claim 1
Independent Claim
122 words
A method of restoring a computer program infected by a computer virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) storing said unique fingerprint prior to said program being infected and data relating to a beginning portion of said program at a separate location; c) generating a fingerprint of a string in said program which is thought to be infected utilizing said stored data; d) comparing the fingerprint generated in step c) with the fingerprint stored in step b) and determining that the program can be restored if said fingerprints match; e) restoring said program from said string and said stored data if said comparison in step d) determines that restoration is possible.
Claim 2
Dependent Claim
48 words
The method according to claim 1 further comprising the steps of: f) selecting a string adjacent said string; g) repeating steps c), d) and e) of claim 1; h) repeating steps f) and g) until said program is restored or a predetermined number of strings have been tested.
Claim 3
Independent Claim
162 words
A method of restoring a computer program infected by a computer virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) storing at a separate location after storing said unique fingerprint, data relating to a beginning portion of said program and a lenght of said program prior to said program being infected; c) selecting a starting location in said program having an address which exceeds a length of said stored beginning portion by a predetermined number; d) generating a fingerprint of a continuous string in said program, having a length equal to said stored program length, utilizing said stored data relating to said beginning portion; e) comparing the fingerprint generated in step c) with the fingerprint stored in step b) and determining that the program can be restored if said fingerprints match; f) restoring said program from said string and said stored data if said comparison in step e) determines that restoration is possible.
Claim 4
Dependent Claim
49 words
The method according to claim 10 further comprising the steps of: g) incrementing the address of said starting location; h) repeating steps d), e) and f); i) repeating steps g) and h) until said program is restored or a predetermined number of increments in said address have been implemented.
Claim 5
Independent Claim
188 words
A method of restoring a computer program infected by a computer virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) storing at a separate location said unique fingerprint, data relating to a beginning portion of said program and a length of said program prior to said program being infected; c) generating a fingerprint of a string formed of first and second sub-strings, said first sub-string having a starting point which is after an ending point of said program and having a predetermined length, said second sub-string having a starting point offset from a beginning of said program by said predetermined length, the combined lengths of said first and second sub-strings being equal to said stored program length, said fingerprint being generated utilizing said stored data relating to said beginning portion; d) comparing the fingerprint generated in step c) with the fingerprint stored in step b) and determining that the program can be restored if said fingerprints match; e) restoring said program from said string and said stored data if said comparison in step d) determines that restoration is possible.
Claim 6
Dependent Claim
47 words
The method according to claim 16 further comprising the steps of: f) incrementing said starting point; g) repeating steps c), d) and e); h) repeating steps f) and g) until said program is restored or a predetermined number of increments in said starting point has been implemented.
Claim 7
Independent Claim
211 words
A method of restoring a computer program having fixup tables and being infected by a computer virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) storing at a separate location said unique fingerprint, data relating to a beginning portion, of said program and a length of said program prior to said program being infected; c) determining a length of said virus; d) determining an integer fixup shift equal to said virus length divided by 16; e) generating a modified fixup table having a segment portion of each address reduced by said fixup shift; f) generating a fingerprint of a concatenation of said stored beginning portion, said modified fixup table and a continuous string having a starting point equal to 16 times said fixup shift bytes after an end of said fixup table and having a length of said stored length of said fixup table and minus said stored length of said beginning portion; g) comparing the fingerprint generated in step c) with the fingerprint stored in step b) and determining that the program can be restored if said fingerprints match; h) restoring said program from said string and said stored data if said comparison in step d) determines that restoration is possible.
Claim 8
Dependent Claim
50 words
The method according to claim 19 further comprising the steps of: i) incrementing said integer fixup shift; j) repeating steps d), e), f), g) and h) k) repeating steps i) and j) until said program is restored or a predetermined number of increments of said fixup shift have been implemented.
Claim 9
Independent Claim
155 words
A method of restoring a computer program infected by a computer virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) generating a first string which is a transitive invertable function of a first plurality of substrings of said program; c) storing said unique fingerprint and said first string prior to said program being infected at a separate location; d) generating a substring of said program from said first string and said program; e) generating a fingerprint of a second string formed ofa second plurality of substrings of said program and a trial sub-string generated from said program and said first string; f) comparing the fingerprint generated in step e) with the fingerprint saved at step c) and determining that said program can be restored if said fingerprints match; g) restoring said program from said substrings if said comparison in step f) determines that restoration is possible.
Claim 10
Dependent Claim
15 words
The method according to claim 1 where said transitive invertable function is an exclusive OR.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.