US5408642A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method for recovery of a computer program infected by a computer virus
Assignee: Gen Digital Inc
•
Filing: 1991-05-24
•
Granted: 1995-04-18
•
Expires: 2011-05-24
Abstract
Abstract A recovery technique allows a computer program to be recovered from a program which has been infected with a computer virus. Prior to the program being infected, a unique fingerprint of the program is taken and stored along with data relating to the beginning portion of the program at a location separate from the program. A program thought to be infected is processed by generating a fingerprint of a string in the program utilizing the stored data. The fingerprint that is generated is compared with the stored fingerprint to determine whether or not the two fingerprints match. If the fingerprints match, the program is restored from the stored information and the string. If the fingerprints do not match, the value utilized to select the string can be incremented and the process repeated.
Inventors
- 👤 Omri Mann
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-27 23:30
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/565; G06F21/568; G06F11/00; G06F11/07; G06F11/14; G06F11/1402
Claims Analysis
Total Claims: 25
Claim 1
Independent Claim
123 words
A method of restoring a computer program infected by a computer virus by removing said virus comprising: a) a generating a unique fingerprint for a computer program prior to said program being infected; b) prior to said program being infected storing said unique fingerprint and data relating to a beginning portion of said program at a separate location; c) utilizing said stored data for generating a fingerprint of a string in said infected program; d) comparing the fingerprint generated in step c) with the fingerprint stored in step b) and determining that the program can be restored if said fingerprints match; e) restoring said program from said string and said stored data if said comparison in step d) determines that restoration is possible.
Claim 2
Independent Claim
123 words
A method of restoring a computer program infected by a computer virus by removing said virus comprising: a) a generating a unique fingerprint for a computer program prior to said program being infected; b) prior to said program being infected storing said unique fingerprint and data relating to a beginning portion of said program at a separate location; c) utilizing said stored data for generating a fingerprint of a string in said infected program; d) comparing the fingerprint generated in step c) with the fingerprint stored in step b) and determining that the program can be restored if said fingerprints match; e) restoring said program from said string and said stored data if said comparison in step d) determines that restoration is possible.
Claim 3
Dependent Claim
48 words
The method according to claim 1 further comprising the steps of: f) selecting a string adjacent said string; g) repeating steps c), d) and e) of claim 1; h) repeating steps f) and g) until said program is restored or a predetermined number of strings have been tested.
Claim 4
Dependent Claim
17 words
The method according to claim 1 wherein said string is a concatenation of a plurality of sub-strings.
Claim 5
Dependent Claim
30 words
The method according to claim 1 wherein said data stored in step b) includes a length of said program and said string utilized in step c) is of said length.
Claim 6
Dependent Claim
19 words
The method according to claim 1 wherein said beginning portion of said program includes a header of the program.
Claim 7
Dependent Claim
17 words
The method according to claim 1 wherein said fingerprint comprises an error detecting code for said program.
Claim 8
Dependent Claim
16 words
The method according to claim 6 wherein said error detecting code is a cyclic redundancy check.
Claim 9
Dependent Claim
14 words
The method according to claim 6 wherein said error detecting code is a checksum.
Claim 10
Dependent Claim
21 words
The method according to claim 6 wherein said error detecting code is an exclusive - OR of words in said program.
Claim 11
Independent Claim
163 words
A method of restoring a computer program infected by a computer virus by removing said virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) storing, at a separate location, said unique fingerprint, data relating to a beginning portion of said program and a length of said program prior to said program being infected; c) selecting a starting location in said program having an address which exceeds a length of said stored beginning portion by a predetermined number; d) generating a fingerprint of a continuous string in said program, having a length equal to said stored program length, utilizing said stored data relating to said beginning portion; e) comparing the fingerprint generated in step c) with the fingerprint stored-in step b) and determining that the program can be restored if said fingerprints match; f) restoring said program from said string and said stored data if said comparison in step e) determines that restoration is possible.
Claim 12
Independent Claim
163 words
A method of restoring a computer program infected by a computer virus by removing said virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) storing, at a separate location, said unique fingerprint, data relating to a beginning portion of said program and a length of said program prior to said program being infected; c) selecting a starting location in said program having an address which exceeds a length of said stored beginning portion by a predetermined number; d) generating a fingerprint of a continuous string in said program, having a length equal to said stored program length, utilizing said stored data relating to said beginning portion; e) comparing the fingerprint generated in step c) with the fingerprint stored-in step b) and determining that the program can be restored if said fingerprints match; f) restoring said program from said string and said stored data if said comparison in step e) determines that restoration is possible.
Claim 13
Dependent Claim
49 words
The method according to claim 10 further comprising the steps of: g) incrementing the address of said starting location; h) repeating steps d), e) and f); i) repeating steps g) and h) until said program is restored or a predetermined number of increments in said address have been implemented.
Claim 14
Dependent Claim
17 words
The method according to claim 10 wherein said fingerprint comprises an error detecting code for said program.
Claim 15
Dependent Claim
16 words
The method according to claim 12 wherein said error detecting code is a cyclic redundancy check.
Claim 16
Dependent Claim
14 words
The method according to claim 12 wherein said error detecting code is a checksum.
Claim 17
Dependent Claim
21 words
The method according to claim 12 wherein said error detecting code is an exclusive - OR of words in said program.
Claim 18
Independent Claim
183 words
A method of restoring a computer program infected by a computer virus by removing said virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) storing, at a separate location, said unique fingerprint, and a length of said program prior to said program being infected; c) generating a fingerprint of a string formed of first and second sub-strings, said first sub-string having a starting point which is after an ending point of said program and having a predetermined length, said second sub-string having a starting point offset from a beginning of said program by said predetermined length, the combined lengths of said first and second sub-strings being equal to said stored program length, said fingerprint being generated utilizing said stored data relating to said beginning portion; d) comparing the fingerprint generated in step c) with the fingerprint stored in step b) and determining that the program can be restored if said fingerprints match; e) restoring said program from said string and said stored data if said comparison in step d) determines that restoration is possible.
Claim 19
Independent Claim
183 words
A method of restoring a computer program infected by a computer virus by removing said virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) storing, at a separate location, said unique fingerprint, and a length of said program prior to said program being infected; c) generating a fingerprint of a string formed of first and second sub-strings, said first sub-string having a starting point which is after an ending point of said program and having a predetermined length, said second sub-string having a starting point offset from a beginning of said program by said predetermined length, the combined lengths of said first and second sub-strings being equal to said stored program length, said fingerprint being generated utilizing said stored data relating to said beginning portion; d) comparing the fingerprint generated in step c) with the fingerprint stored in step b) and determining that the program can be restored if said fingerprints match; e) restoring said program from said string and said stored data if said comparison in step d) determines that restoration is possible.
Claim 20
Dependent Claim
47 words
The method according to claim 16 further comprising the steps of: f) incrementing said predetermined length; g) repeating steps c), d) and e); h) repeating steps f) and g) until said program is restored or a predetermined number of increments in said starting point has been implemented.
Claim 21
Dependent Claim
17 words
The method according to claim 16 wherein said fingerprint comprises an error detecting code for said program.
Claim 22
Independent Claim
218 words
A method of restoring a computer program having fixup tables and being infected by a computer virus by removing said virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) storing, at a separate location, said unique fingerprint, data relating to a beginning portion, of said program and a length of said program prior to said program being infected; c) determining a length of said virus; d) determining an integer fixup shift equal to said virus length divided by 16; e) generating a modified fixup table having a segment portion of each address reduced by said fixup shift; f) generating a fingerprint of a concatenation of said stored beginning portion, said modified fixup table and a continuous string having a starting point equal to 16 times said fixup shift bytes after an end of said fixup table and having a length of said stored length minus a length of said fixup table and minus said stored length of said beginning portion; g) comparing the fingerprint generated in step c) with the fingerprint stored in step b) and determining that the program can be restored if said fingerprints match; h) restoring said program from said string and said stored data if said comparison in step d) determines that restoration is possible.
Claim 23
Independent Claim
218 words
A method of restoring a computer program having fixup tables and being infected by a computer virus by removing said virus comprising: a) generating a unique fingerprint for a computer program prior to said program being infected; b) storing, at a separate location, said unique fingerprint, data relating to a beginning portion, of said program and a length of said program prior to said program being infected; c) determining a length of said virus; d) determining an integer fixup shift equal to said virus length divided by 16; e) generating a modified fixup table having a segment portion of each address reduced by said fixup shift; f) generating a fingerprint of a concatenation of said stored beginning portion, said modified fixup table and a continuous string having a starting point equal to 16 times said fixup shift bytes after an end of said fixup table and having a length of said stored length minus a length of said fixup table and minus said stored length of said beginning portion; g) comparing the fingerprint generated in step c) with the fingerprint stored in step b) and determining that the program can be restored if said fingerprints match; h) restoring said program from said string and said stored data if said comparison in step d) determines that restoration is possible.
Claim 24
Dependent Claim
50 words
The method according to claim 19 further comprising the steps of: i) decrementing said integer fixup shift; j) repeating steps d), e), f), g) and h) k) repeating steps i) and j) until said program is restored or a predetermined number of decrements of said fixup shift have been implemented.
Claim 25
Dependent Claim
17 words
The method according to claim 19 wherein said fingerprint comprises an error detecting code for said program.
References Cited (Backward Citations)
US5050212A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1998-04-17 | 1998-10-17 | 1999-04-18 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2002-04-17 | 2002-10-17 | 2003-04-18 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2006-04-17 | 2006-10-17 | 2007-04-18 | $7700.00 | Window Closed / Lapsed |