US5502815A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for increasing the speed at which computer viruses are detected
Assignee: McAfee LLC
•
Filing: 1992-03-30
•
Granted: 1996-03-26
•
Expires: 2012-03-30
Abstract
Abstract The method and apparatus for increasing the speed at which computer viruses are detected stores initial state information concerning the file or volume which is being examined for a virus. This information is stored in a cache in a non-volatile storage medium and when files are subsequently scanned for viruses, the current state information is compared to the initial state information stored in the cache. If the initial state information differs from the current state information then the file or volume is scanned for viruses which change the state information of the file or volume. If the initial state information and current state information is the same then the file or volume is scanned for a subset of viruses which do not change the state information.
Inventors
- 👤 Paul D. Cozza
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-27 15:31
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/565; G06F21/564
Claims Analysis
Total Claims: 32
Claim 1
Independent Claim
152 words
A method for increasing the speed at which a computer scans for the presence of a computer virus, said method comprising the steps of: gathering initial state information about an initial state of a file; storing said initial state information in a scan information cache on a non-volatile storage medium; gathering current state information about a current state of said file; determining whether said initial state information for said file stored in said scan information cache differs from said current state information thereby indicating the potential presence of a computer virus which alters the current state information of said file; scanning said file, for only a subset of all viruses, if said file is determined to have initial state information in said scan information cache which is the same as said current state information, said subset including only viruses would not cause an alteration in said current state information for said file.
Claim 2
Independent Claim
152 words
A method for increasing the speed at which a computer scans for the presence of a computer virus, said method comprising the steps of: gathering initial state information about an initial state of a file; storing said initial state information in a scan information cache on a non-volatile storage medium; gathering current state information about a current state of said file; determining whether said initial state information for said file stored in said scan information cache differs from said current state information thereby indicating the potential presence of a computer virus which alters the current state information of said file; scanning said file, for only a subset of all viruses, if said file is determined to have initial state information in said scan information cache which is the same as said current state information, said subset including only viruses would not cause an alteration in said current state information for said file.
Claim 3
Dependent Claim
37 words
A method for increasing the speed at which a computer scans for the presence of a computer virus of claim 1 wherein said subset of viruses includes viruses that do not alter state information of a file.
Claim 4
Dependent Claim
51 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 1 further comprising the step of scanning said file, for a full complement of viruses, if said initial state information is not found in said scan information cache for said file.
Claim 5
Dependent Claim
71 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 1 further comprising the step of scanning said file, for a second subset of all viruses which modify said current state information in said scan information cache, if said file is determined to have said initial state information in said scan information cache which is different than said current state information.
Claim 6
Dependent Claim
57 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 1 further comprising the step of updating said scan information cache by placing a value, indicating the presence of a virus, in said scan information cache which corresponds to said file in which a virus is found.
Claim 7
Dependent Claim
48 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 1 further comprising the step of updating said scan information cache with new information concerning a state of said file if no virus is found in said file.
Claim 8
Dependent Claim
56 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 1 further comprising the step of scanning said file, for all viruses, if said file is determined to have said initial state information in said scan information cache which is different than said current state information.
Claim 9
Independent Claim
157 words
A method for increasing the speed at which a computer scans for the presence of a computer virus, said method comprising the steps of: gathering initial state information about an initial state of a volume; storing said initial state information in a scan information cache on a non-volatile storage medium; gathering current state information about a current state of said volume; determining whether said initial state information for said volume stored in the scan information cache differs from said current state information for said volume thereby indicating the potential presence of a computer virus which alters the current state information of said volume; scanning said volume, for only a subset of all viruses, if said volume is determined to have initial state information stored in the scan information cache which is the same as said current state information, said subset including only viruses which would not cause an alteration in said current state information for said file.
Claim 10
Independent Claim
157 words
A method for increasing the speed at which a computer scans for the presence of a computer virus, said method comprising the steps of: gathering initial state information about an initial state of a volume; storing said initial state information in a scan information cache on a non-volatile storage medium; gathering current state information about a current state of said volume; determining whether said initial state information for said volume stored in the scan information cache differs from said current state information for said volume thereby indicating the potential presence of a computer virus which alters the current state information of said volume; scanning said volume, for only a subset of all viruses, if said volume is determined to have initial state information stored in the scan information cache which is the same as said current state information, said subset including only viruses which would not cause an alteration in said current state information for said file.
Claim 11
Dependent Claim
37 words
A method for increasing the speed at which a computer scans for the presence of a computer virus of claim 8 wherein said subset of viruses includes viruses that do not alter state information of a volume.
Claim 12
Dependent Claim
51 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 8 further comprising the step of scanning said volume, for a full complement of viruses, if said initial state information is not found in said scan information cache for said volume.
Claim 13
Dependent Claim
71 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 8 further comprising the step of scanning said file, for a second subset of all viruses which modify said current state information in said scan information cache, if said file is determined to have said initial state information in said scan information cache which is different than said current state information.
Claim 14
Dependent Claim
57 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 8 further comprising the step of updating said scan information cache by placing a value, indicating the presence of a virus, in said scan information cache which corresponds to said volume in which a virus is found.
Claim 15
Dependent Claim
49 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 8 further comprising the step of updating said scan information cache with new information concerning a current state of said volume if no virus is found in said volume.
Claim 16
Dependent Claim
56 words
The method for increasing the speed at which a computer scans for the presence of a computer virus of claim 8 further comprising the step of scanning said volume, for all viruses, if said volume is determined to have said initial state information in said scan information cache which is different than said current state information.
Claim 17
Independent Claim
177 words
An apparatus that can rapidly scan for the presence of a computer virus comprising: a scan information cache on a non-volatile storage medium; means for gathering initial state information about an initial state of a file stored on a memory device; means for storing said initial state information in said scan information cache; means for gathering current state information about a current state of said file; means for determining whether said initial state information for said file stored in the scan information cache differs from said current state information for said file thereby indicating the potential presence of a computer virus which alters the current state information of said file; means for scanning said file, for only a subset of all viruses, if said file is determined to have the initial state information stored in the scan information cache which is the same as said current state information, said means for scanning being connected to said memory device, said subset including only viruses which would not cause an alteration in said current state information for said file.
Claim 18
Independent Claim
177 words
An apparatus that can rapidly scan for the presence of a computer virus comprising: a scan information cache on a non-volatile storage medium; means for gathering initial state information about an initial state of a file stored on a memory device; means for storing said initial state information in said scan information cache; means for gathering current state information about a current state of said file; means for determining whether said initial state information for said file stored in the scan information cache differs from said current state information for said file thereby indicating the potential presence of a computer virus which alters the current state information of said file; means for scanning said file, for only a subset of all viruses, if said file is determined to have the initial state information stored in the scan information cache which is the same as said current state information, said means for scanning being connected to said memory device, said subset including only viruses which would not cause an alteration in said current state information for said file.
Claim 19
Dependent Claim
32 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 15 wherein said subset of viruses includes viruses that do not alter state information of a file.
Claim 20
Dependent Claim
42 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 15 further comprising means for scanning said file, for all viruses, if said initial state information is not found in said scan information cache for said file.
Claim 21
Dependent Claim
74 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 15 further comprising means for scanning said file, for a second subset of all viruses which modify said current state information in said scan information cache, if said file is determined to have initial state information in said scan information cache which is different than said current state information, said means for scanning being connected to said memory device.
Claim 22
Dependent Claim
51 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 15 further comprising means for updating said scan information cache by placing a value, indicating the presence of a virus, in said scan information cache which corresponds to said file in which a virus is found.
Claim 23
Dependent Claim
43 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 15 further comprising means for updating said scan information cache with new information concerning a current state of said file if no virus is found in said file.
Claim 24
Dependent Claim
49 words
An apparatus that can rapidly scan for the presence of a computer virus of claim 15 further comprising means for scanning said file, for all viruses, if said file is determined to have initial state information in said scan information cache which is different than said current state information.
Claim 25
Independent Claim
174 words
An apparatus that can rapidly scan for the presence of a computer virus comprising: a scan information cache on a non-volatile storage medium; means for gathering initial state information about an initial state of a volume stored on a memory device; means for storing said initial state information in said scan information cache; means for gathering current state information about a current state of said volume; means for determining whether said initial state information for said volume stored in the scan information cache differs from said current state information for said volume thereby indicating the potential presence of a computer virus which alters the state of said volume; means for scanning said volume, for only a subset of viruses, if said volume is determined to have said initial state information stored in the scan information cache which is the same as said current state information, said means for scanning being connected to said memory device, said subset including only viruses which would not cause an alteration in said current state information for said file.
Claim 26
Independent Claim
174 words
An apparatus that can rapidly scan for the presence of a computer virus comprising: a scan information cache on a non-volatile storage medium; means for gathering initial state information about an initial state of a volume stored on a memory device; means for storing said initial state information in said scan information cache; means for gathering current state information about a current state of said volume; means for determining whether said initial state information for said volume stored in the scan information cache differs from said current state information for said volume thereby indicating the potential presence of a computer virus which alters the state of said volume; means for scanning said volume, for only a subset of viruses, if said volume is determined to have said initial state information stored in the scan information cache which is the same as said current state information, said means for scanning being connected to said memory device, said subset including only viruses which would not cause an alteration in said current state information for said file.
Claim 27
Dependent Claim
32 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 22 wherein said subset of viruses includes viruses that do not alter state information of a volume.
Claim 28
Dependent Claim
42 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 22 further comprising means for scanning said volume, for all viruses, if said initial state information is not found in said scan information cache for said volume.
Claim 29
Dependent Claim
75 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 22 further comprising means for scanning said volume, for a second subset of all viruses which modify said current state information in said scan information cache, if said volume is determined to have said initial state information in said scan information cache which is different than said current state information said means for scanning being connected to said memory device.
Claim 30
Dependent Claim
51 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 22 further comprising means for updating said scan information cache by placing a value, indicating the presence of a virus, in said scan information cache which corresponds to said volume in which a virus is found.
Claim 31
Dependent Claim
43 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 22 further comprising means for updating said scan information cache with new information concerning a current state of said volume if no virus is found in said volume.
Claim 32
Dependent Claim
50 words
An apparatus that can rapidly scan for the presence of a computer virus of claim 22 further comprising means for scanning said volume, for all viruses, if said volume is determined to have said initial state information in said scan information cache which is different than said current state information.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1999-03-26 | 1999-09-25 | 2000-03-26 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2003-03-26 | 2003-09-25 | 2004-03-26 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2007-03-26 | 2007-09-25 | 2008-03-26 | $7700.00 | Window Closed / Lapsed |