US5473769A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for increasing the speed of the detecting of computer viruses
Assignee: McAfee LLC
•
Filing: 1992-08-31
•
Granted: 1995-12-05
•
Expires: 2012-08-31
Abstract
Abstract A method and apparatus for increasing the speed at which a computer can scan files for computer viruses examines the initial state information of each file and stores this state information in a cache. Since viruses generally add themselves to preexisting files, they generally change the lengths or other characteristics of the files. During a scan, current state information is gathered regarding the length and/or other characteristics of the current state of the file and this information is compared to the length and characteristics from the initial state of the file. If the initial state information is different than the current state information then the files are scanned for certain subsets of viruses which affect files in a manner which is determined by the differences in such initial and current state information.
Inventors
- 👤 Paul D. Cozza
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-01 03:48
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/565; G06F21/564; H; H04; H04L; H04L51/00; H04L51/21; H04L51/212
Claims Analysis
Total Claims: 20
Claim 1
Independent Claim
154 words
A method for increasing the speed at which a computer scans for the presence of a computer virus, said method comprising the steps of: gathering initial state information about an initial state of a file and storing said initial state information in a scan information cache on a non-volatile storage medium; storing said initial state information in said scan information cache; gathering current state information about a current state of said file; determining how said initial state information stored in said scan information cache for said file differs from said current state information thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affect state information of said file in certain characteristic manners; scanning said file for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present.
Claim 2
Independent Claim
154 words
A method for increasing the speed at which a computer scans for the presence of a computer virus, said method comprising the steps of: gathering initial state information about an initial state of a file and storing said initial state information in a scan information cache on a non-volatile storage medium; storing said initial state information in said scan information cache; gathering current state information about a current state of said file; determining how said initial state information stored in said scan information cache for said file differs from said current state information thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affect state information of said file in certain characteristic manners; scanning said file for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present.
Claim 3
Dependent Claim
74 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 1 further comprising the step of scanning said file, for which said initial state information is not found in said scan information cache, for a subset of those viruses which infect computers of the same type as said computer, said subset including viruses that can infect files of the same type as said file.
Claim 4
Dependent Claim
64 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 1 further comprising the step of updating said scan information cache by placing a specific indicative value in at least one memory location in said scan information cache, said at least one memory location corresponding to a file in which a virus is found.
Claim 5
Dependent Claim
48 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 1 further comprising the step of updating said scan information cache with new information concerning a state of said file if no virus is found in said file.
Claim 6
Independent Claim
157 words
A method for increasing the speed at which a computer scans for the presence of a computer virus, said method comprising the steps of: gathering initial state information about an initial state of a volume and storing said initial state information in a scan information cache on a non-volatile storage medium; storing said initial state information in said scan information cache; gathering current state information about a current state of said volume; determining how said initial state information stored in said scan information cache for said volume differs from said current state information for said volume thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affects state information of said volume in certain characteristic manners; scanning said volume for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present.
Claim 7
Independent Claim
157 words
A method for increasing the speed at which a computer scans for the presence of a computer virus, said method comprising the steps of: gathering initial state information about an initial state of a volume and storing said initial state information in a scan information cache on a non-volatile storage medium; storing said initial state information in said scan information cache; gathering current state information about a current state of said volume; determining how said initial state information stored in said scan information cache for said volume differs from said current state information for said volume thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affects state information of said volume in certain characteristic manners; scanning said volume for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present.
Claim 8
Dependent Claim
74 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 5 further comprising the step of scanning said volume, for which said initial state information is not found in said scan information cache, for a subset of those viruses which infect computers of the same type as said computer, said subset including viruses that can infect volumes of the same type as said volume.
Claim 9
Dependent Claim
64 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 5 further comprising the step of updating said scan information cache by placing a specific indicative value in at least one memory location in said scan information cache, said at least one memory location corresponding to a volume in which a virus is found.
Claim 10
Dependent Claim
48 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 5 further comprising the step of updating said scan information cache with new information concerning a state of said volume if no virus is found in said volume.
Claim 11
Independent Claim
183 words
An apparatus that can rapidly scan for the presence of a computer virus comprising: a scan information cache on a non-volatile storage medium; means for gathering initial state information about an initial state of a file stored on a computer storage medium and storing said initial state information in said scan information cache; means for storing said initial state information in said scan information cache; means for gathering current state information about a current state of said file; means for determining how said initial state information stored in said scan information cache for said file differs from said current state information for said file thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affect state information of said file in certain characteristic manners; means for scanning said file for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present, said means for scanning being operated by a computer having access to said computer storage medium.
Claim 12
Independent Claim
183 words
An apparatus that can rapidly scan for the presence of a computer virus comprising: a scan information cache on a non-volatile storage medium; means for gathering initial state information about an initial state of a file stored on a computer storage medium and storing said initial state information in said scan information cache; means for storing said initial state information in said scan information cache; means for gathering current state information about a current state of said file; means for determining how said initial state information stored in said scan information cache for said file differs from said current state information for said file thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affect state information of said file in certain characteristic manners; means for scanning said file for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present, said means for scanning being operated by a computer having access to said computer storage medium.
Claim 13
Dependent Claim
68 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 9 further comprising means for scanning said file, for which said initial state information is not found in said scan information cache, for a subset of those viruses which infect computers of the same type as said computer, said subset including viruses that can infect files of the same type as said file.
Claim 14
Dependent Claim
58 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 9 further comprising means for updating said scan information cache by placing a specific indicative value in at least one memory location in said scan information cache, said at least one memory location corresponding to a file in which a virus is found.
Claim 15
Dependent Claim
42 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 9 further comprising means for updating said scan information cache with new information concerning a state of said file if no virus is found in said file.
Claim 16
Independent Claim
184 words
An apparatus that can rapidly scan for the presence of a computer virus comprising: a scan information cache on a non-volatile storage medium; means for gathering initial state information about an initial state of a volume stored on a computer storage medium and storing said initial state information in said scan information cache; means for storing said initial state information in said scan information cache; means for gathering current state information about a current state of said volume; means for determining how said initial state information stored in said scan information cache for said volume differs from said current state information for said volume thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses each which affect state information of said volume in certain characteristic manners; means for scanning said volume for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present, said means for scanning being operated by a computer having access to said computer storage medium.
Claim 17
Independent Claim
184 words
An apparatus that can rapidly scan for the presence of a computer virus comprising: a scan information cache on a non-volatile storage medium; means for gathering initial state information about an initial state of a volume stored on a computer storage medium and storing said initial state information in said scan information cache; means for storing said initial state information in said scan information cache; means for gathering current state information about a current state of said volume; means for determining how said initial state information stored in said scan information cache for said volume differs from said current state information for said volume thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses each which affect state information of said volume in certain characteristic manners; means for scanning said volume for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present, said means for scanning being operated by a computer having access to said computer storage medium.
Claim 18
Dependent Claim
68 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 13 further comprising means for scanning said volume, for which said initial state information is not found in said scan information cache, for a subset of those viruses which infect computers of the same type as said computer, said subset including viruses that can infect volumes of the same type as said volume.
Claim 19
Dependent Claim
59 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 13 further comprising the step of updating said scan information cache by placing a specific indicative value in at least one memory location in said scan information cache, said at least one memory location corresponding to a volume in which a virus is found.
Claim 20
Dependent Claim
43 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 13 further comprising the step of updating said scan information cache with new information concerning a state of said volume if no virus is found in said volume.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1998-12-04 | 1999-06-05 | 1999-12-05 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2002-12-04 | 2003-06-05 | 2003-12-05 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2006-12-04 | 2007-06-05 | 2007-12-05 | $7700.00 | Window Closed / Lapsed |