US5349655A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method for recovery of a computer program infected by a computer virus
Assignee: Gen Digital Inc
•
Filing: 1992-05-12
•
Granted: 1994-09-20
•
Expires: 2012-05-12
Abstract
Abstract A recovery technique allows a computer program to be recovered from a program which has been infected with a computer virus. Prior to the program being infected, a unique fingerprint of the program is taken and stored along with data relating to the beginning portion of the program at a location separate from the program. A program thought to be infected is processed by generating a fingerprint of a string in the program utilizing the stored data. The fingerprint that is generated is compared with the stored fingerprint to determine whether or not the two fingerprints match. If the fingerprints match, the program is restored from the stored information and the string. If the fingerprints do not match, the value utilized to select the string can be incremented and the process repeated.
Inventors
- 👤 Omri Mann
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 12:46
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/565; G06F21/568; G06F11/00; G06F11/07; G06F11/14; G06F11/1402
Claims Analysis
Total Claims: 8
Claim 1
Independent Claim
197 words
A method of restoring a computer program infected by a computer virus comprising: (a) generating a unique fingerprint for a computer program prior to said computer program being infected; (b) generating a first string which is a transitive function of a first plurality of substrings of said computer program said function having an inverse function for calculating an unknown input given all other inputs and a value of the function; (c) storing said unique fingerprint and said first string prior to said computer program being infected at a separate location; (d) generating a substring of said computer program from said first string and said computer program by utilizing said inverse function; (e) generating a fingerprint of a second string formed of a second plurality of substrings of said computer program and a trial substring generated from said computer program and said first string; (f) comparing the fingerprint generated in step e) with the fingerprint saved at step c) and determining that said computer program can be restored if said fingerprints match; (g) restoring said computer program as said second plurality of substrings and said trial substring if said comparison in step f) determines that restoration is possible.
Claim 2
Independent Claim
197 words
A method of restoring a computer program infected by a computer virus comprising: (a) generating a unique fingerprint for a computer program prior to said computer program being infected; (b) generating a first string which is a transitive function of a first plurality of substrings of said computer program said function having an inverse function for calculating an unknown input given all other inputs and a value of the function; (c) storing said unique fingerprint and said first string prior to said computer program being infected at a separate location; (d) generating a substring of said computer program from said first string and said computer program by utilizing said inverse function; (e) generating a fingerprint of a second string formed of a second plurality of substrings of said computer program and a trial substring generated from said computer program and said first string; (f) comparing the fingerprint generated in step e) with the fingerprint saved at step c) and determining that said computer program can be restored if said fingerprints match; (g) restoring said computer program as said second plurality of substrings and said trial substring if said comparison in step f) determines that restoration is possible.
Claim 3
Dependent Claim
14 words
The method according to claim 1 where said transitive function is an exclusive OR.
Claim 4
Dependent Claim
13 words
The method according to claim 1 where said transitive function is a sum.
Claim 5
Dependent Claim
18 words
The method according to claim 1 wherein said fingerprint comprises an error detecting code for said computer program.
Claim 6
Dependent Claim
16 words
The method according to claim 4 wherein said error detecting code is a cyclic redundancy check.
Claim 7
Dependent Claim
14 words
The method according to claim 4 wherein said error detecting code is a checksum.
Claim 8
Dependent Claim
20 words
The method according to claim 4 wherein said error detecting code is an exclusive-OR of words in said computer program.
References Cited (Backward Citations)
US4734856A
Cited
US5144660A
Cited
US4975950A
Cited
US5121345A
Cited
US5050212A
Cited
US5274807A
Cited
US5163088A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1997-09-19 | 1998-03-21 | 1998-09-20 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2001-09-19 | 2002-03-21 | 2002-09-20 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2005-09-19 | 2006-03-21 | 2006-09-20 | $7700.00 | Window Closed / Lapsed |