US5613002A — Generic disinfection of programs infected with a …

Claim 1

Independent Claim 238 words

For a program initially having a non-infected state that subsequently attains an infected state as a result of infection with a computer virus, a method for restoring the computer program from the infected state to the non-infected state, comprising: (a) storing, in a computer memory, electrical signals representing a plurality of parameters of the program in the non-infected state, the parameters comprising: i. the length, in bytes, of the program in the non-infected state; ii. a checksum of the program in the non-infected state; iii. information pertaining to bytes in the program in the non-infected state, near the beginning of the program in the non-infected state, designated BeginInfo; iv. information pertaining to bytes in the program in the non-infected state near the end of the program, designated EndInfo; (b) scanning the program in the infected state for a first sequence of bytes characterized by BeginInfo, and for a second sequence of bytes characterized by EndInfo; (c) generating one or more trial program reconstructions, based upon byte sequences found in the program in the infected state; (d) computing a checksum of each trial program reconstruction; (e) comparing the checksum of the each trial program reconstruction with the checksum of the program in the non-infected state; (f) using the trial program reconstruction possessing a checksum equal to the checksum of the program in the non-infected state, if it exists, restoring the program from the infected state to the non-infected state.

Claim 2

Dependent Claim 238 words

For a program initially having a non-infected state that subsequently attains an infected state as a result of infection with a computer virus, a method for restoring the computer program from the infected state to the non-infected state, comprising: (a) storing, in a computer memory, electrical signals representing a plurality of parameters of the program in the non-infected state, the parameters comprising: i. the length, in bytes, of the program in the non-infected state; ii. a checksum of the program in the non-infected state; iii. information pertaining to bytes in the program in the non-infected state, near the beginning of the program in the non-infected state, designated BeginInfo; iv. information pertaining to bytes in the program in the non-infected state near the end of the program, designated EndInfo; (b) scanning the program in the infected state for a first sequence of bytes characterized by BeginInfo, and for a second sequence of bytes characterized by EndInfo; (c) generating one or more trial program reconstructions, based upon byte sequences found in the program in the infected state; (d) computing a checksum of each trial program reconstruction; (e) comparing the checksum of the each trial program reconstruction with the checksum of the program in the non-infected state; (f) using the trial program reconstruction possessing a checksum equal to the checksum of the program in the non-infected state, if it exists, restoring the program from the infected state to the non-infected state.

Claim 3

Dependent Claim 20 words

The method of claim 1, wherein the checksum of the program in the non-infected state is a cyclical redundancy check.

Claim 4

Dependent Claim 28 words

The method of claim 1, wherein BeginInfo includes an initial number HeaderLength of bytes of the program in the non-infected state, where HeaderLength is a chosen non-negative constant.

Claim 5

Dependent Claim 65 words

The method of claim 3, wherein BeginInfo further includes: (a) BeginTag, wherein BeginTag represents the result of applying a function BeginTagFunction to a contiguous region comprising a number BeginTagLength bytes following the initial number HeaderLength of bytes of the program in the non-infected state, where BeginTagLength is a chosen constant; (b) an offset of BeginTag from the beginning of the program in the non-infected state.

Claim 6

Dependent Claim 45 words

The method of claim 4, wherein the contiguous region of bytes is the first contiguous region of BeginTagLength bytes that follows the initial number HeaderLength of bytes of the program in the non-infected state in which not all of the bytes have the same value.

Claim 7

Dependent Claim 36 words

The method of claim 5, wherein the information BeginInfo includes BeginRepeated-Byte, the value of the first byte within the first contiguous region of BeginTagLength bytes in which not all of the bytes have the same value.

Claim 8

Dependent Claim 18 words

The method of claim 4, wherein the function BeginTagFunction of the contiguous region of bytes is the identity.

Claim 9

Dependent Claim 25 words

The method of claim 4, wherein the function BeginTagFunction of the contiguous region of bytes consists of a checksum of the contiguous region of bytes.

Claim 10

Dependent Claim 13 words

The method of claim 8, wherein the checksum is a cyclical redundancy check.

Claim 11

Dependent Claim 118 words

The method of claim 3, wherein: (a) BeginInfo further includes: (i) BeginTag, wherein BeginTag represents the result of applying a function BeginTagFunction to a contiguous region comprising a number BeginTagLength bytes following the initial number HeaderLength of bytes of the program in the non-infected state, where BeginTagLength is a chosen constant; (ii) an offset of BeginTag from the beginning of the program in the non-infected state; (b) EndInfo includes: (i) EndTag, where EndTag represents the result of applying a function EndTagFunction to a contiguous region comprising a number EndTagLength of bytes near the end of the program, wherein EndTagLength is a chosen constant; (ii) an offset of EndTag from the end of the program in the non-infected state.

Claim 12

Dependent Claim 158 words

The method of claim 10, further comprising: (a) computing an offset of BeginTag from the program in the infected state, comprising the steps of: (i) computing a function BeginTagFunction of each contiguous region comprising a number BeginTagLength of bytes in the program in the infected state; (ii) comparing the function BeginTagFunction with BeginTag; (iii) recording in a list BeginOffList an offset of any contiguous region from the beginning of the program in the infected state for which the function BeginTagFunction equals BeginTag; (b) Computing an offset of EndTag from the end of the program in the infected state, comprising the steps of: (i) computing a function EndTagFunction of each contiguous region of EndTagLength bytes in the program in the infected state; (ii) comparing the function EndTagFunction with EndTag; (iii) recording in a list EndOffList an offset EndOffset of any contiguous region from the end of the program in the infected state for which the function EndTagFunction equals EndTag.

Claim 13

Dependent Claim 35 words

The method of claim 11, in which BeginTagFunction is a checksum computed via linear modular-arithmetic, in which the checksums of successive byte sequences in the program in the infected state are computed from previous checksums.

Claim 14

Dependent Claim 58 words

The method of claim 12, in which the checksum is a cyclical redundancy check, and the checksums of successive byte sequences in the program in the infected state are computed from previous checksums as follows: CRC(Bβ)=Rem[Shift[CRC[αB]]]⊕CRC[β]⊕CRC[α0.sup.TagLength ] where B represents a sequence of bytes, α and β are single bytes, and 0 TagLength represents a sequence of zeros.

Claim 15

Dependent Claim 43 words

The method of claim 11, in which EndTagFunctionB is a checksum computed via linear modular-arithmetic, in which the checksums of successive byte sequences in the program in the infected state are computed from checksums computed for preceding byte sequences, i.e., from previous checksums.

Claim 16

Dependent Claim 58 words

The method of claim 14, in which the checksum is a cyclical redundancy check, and the checksums of successive byte sequences in the program in the infected state are computed from previous checksums as follows: CRC(Bβ)=Rem[Shift[CRC[αB]]]⊕CRC[β]⊕CRC[α0.sup.TagLength ] where B represents a sequence of bytes, α and β are single bytes, and 0 TagLength represents a sequence of zeros.

Claim 17

Dependent Claim 170 words

The method of claim 11, in which the step of generating one or more trial reconstructions comprises, for each possible pair of BeginOffset (from BeginOffList) and EndOffset (taken from EndOffList) (a) appending to the bytes of a header contained in a portion of BeginInfo designating a header for the program in the non-infected state a byte sequence BeginSection of length BeginSectionLength starting at offset BeginOffset in the program in the infected state, followed by a byte sequence EndSection of length EndSectionLength ending at offset EndOffset in the program in the infected state; (b) generating a first trial reconstruction with BeginSectionLength of maximal length, and EndSectionLength being of such length that the total length of the trial reconstruction equals the difference in length between the program in the infected and non-infected states; (c) generating successive trial reconstructions such that the last byte of the previous trial reconstructions' BeginSection is removed, and the previous trial reconstruction EndSection is extended backwards to pick up another byte in the program in the infected state.

Claim 18

Dependent Claim 136 words

The method as recited in claim 11, wherein the step of generating one or more trial reconstructions comprises, for each possible pair of BeginOffset (from BeginOffList) and EndOffset (from EndOffList) satisfying the condition that they are separated by the same distance as in the program in the non-infected state: (a) generating a first trial reconstruction comprising all of the bytes of the program in the infected state from BeginOffset to EndOffset, inclusive, except that the first portion is overwritten by a header contained in a portion of BeginInfo designating a header for the program in the non-infected state; (b) generating a series of trial reconstructions, each of which replaces the value of particular bytes in the first trial reconstruction with an estimate of the value of the particular bytes in the program in the non-infected state.

Claim 19

Dependent Claim 66 words

The method as recited in claim 17, wherein the location of bytes to be replaced in the trial reconstruction is determined in part by searching for regions of repeated bytes or groups of bytes, and the estimate of the value of the bytes in the program in the non-infected state is made by extending a pattern representing the regions of repeated bytes or groups of bytes.

Claim 20

Dependent Claim 28 words

The method as recited in claim 18, wherein an end of a region of bytes to be replaced is a byte immediately preceding a region of repeated bytes.

Claim 21

Dependent Claim 35 words

The method as recited in claim 19, wherein, for each successive trial reconstruction, a beginning of the region of bytes to be replaced is extended towards the beginning of the program in the infected state.

Claim 22

Dependent Claim 28 words

The method as recited in claim 18, wherein a beginning of the region of bytes to be replaced is a byte immediately following a region of repeated bytes.

Claim 23

Dependent Claim 33 words

The method as recited in claim 21, wherein, for each successive trial reconstruction, the end of the region of replaced bytes is shifted towards the beginning of the program in the infected state.

Claim 24

Dependent Claim 58 words

The method of claim 1, wherein EndInfo includes: (a) EndTag, where EndTag is the result of applying a function EndTagFunction to a contiguous region comprising a number EndTagLength of bytes near the end of the program, and where EndTagLength is a chosen constant; (b) an offset of EndTag from the end of the program in the non-infected state.

Claim 25

Dependent Claim 33 words

The method of claim 23, wherein the contiguous region of bytes near the end of the program in the non-infected state is the last EndTagLength bytes of the program in the non-infected state.

Claim 26

Dependent Claim 45 words

The method of claim 23, wherein the contiguous region of bytes near the end of the program in the non-infected state is that which is closest first contiguous region comprising a number BeginTagLength of bytes in which all of the bytes have the same value.

Claim 27

Dependent Claim 42 words

The method of claim 25, wherein the information EndInfo includes EndRepeatedByte, the value of the last byte in the contiguous region of EndTagLength bytes closest to the end of the program in which not all of the bytes have the same value.

Claim 28

Dependent Claim 18 words

The method of claim 23, wherein the function EndTagFunction of the contiguous region of bytes is the identity.

Claim 29

Dependent Claim 25 words

The method of claim 23, wherein the function EndTagFunction of the contiguous region of bytes consists of a checksum of the contiguous region of bytes.

Claim 30

Dependent Claim 13 words

The method of claim 28, wherein the checksum is a cyclical redundancy check.

Claim 31

Dependent Claim 22 words

The method of claim 1, in which the checksum of each successive trial reconstruction is computed from that of a preceding reconstruction.

Claim 32

Dependent Claim 93 words

The method of claim 30, in which the checksum is a cyclical redundancy check, and the checksum of each successive trial reconstruction is computed from that of the preceding reconstruction as follows: CRC[AβB]=CRC[AαB]⊕Rem[Mult[ω(n), (α⊕β)]] where Aα is a beginning section of a first trial reconstruction, B is an end section of the first trial reconstruction, A is a beginning section of a second trial reconstruction, βB is an end section of the second trial reconstruction, n is the number of bytes in B, ω(n)=CRC[10 n ], and α and β are single bytes.

Claim 33

Dependent Claim 228 words

For a program capable of having a non-infected state, and an infected state in which the program is infected with a computer virus, a method, when the program is suspected of being in the infected state, for determining when the program has attained the infected state, comprising: (a) storing, in a memory, electrical signals representing a plurality of parameters of the program in the non-infected state, the parameters comprising: i. the length of the program in bytes; ii. a checksum of the program; iii. information pertaining to bytes in the program near the beginning of the program, designated BeginInfo; iv. information pertaining to bytes in the program near the end of the program, designated EndInfo; (b) scanning the program suspected of being in the infected state for a first sequence of bytes characterized by BeginInfo and EndInfo; (c) generating one or more trial program reconstructions of the program in the non-infected state, based upon byte sequences found in the program in the infected state; (d) computing a checksum of each trial program reconstruction; (e) comparing the checksum of the each trial program reconstruction with the checksum of the program in the non-infected state; (f) if any trial program reconstruction possessing a checksum equal to the checksum of the program in the non-infected state can be found, outputting an indication that the computer program is in the infected state.

Claim 34

Dependent Claim 228 words

For a program capable of having a non-infected state, and an infected state in which the program is infected with a computer virus, a method, when the program is suspected of being in the infected state, for determining when the program has attained the infected state, comprising: (a) storing, in a memory, electrical signals representing a plurality of parameters of the program in the non-infected state, the parameters comprising: i. the length of the program in bytes; ii. a checksum of the program; iii. information pertaining to bytes in the program near the beginning of the program, designated BeginInfo; iv. information pertaining to bytes in the program near the end of the program, designated EndInfo; (b) scanning the program suspected of being in the infected state for a first sequence of bytes characterized by BeginInfo and EndInfo; (c) generating one or more trial program reconstructions of the program in the non-infected state, based upon byte sequences found in the program in the infected state; (d) computing a checksum of each trial program reconstruction; (e) comparing the checksum of the each trial program reconstruction with the checksum of the program in the non-infected state; (f) if any trial program reconstruction possessing a checksum equal to the checksum of the program in the non-infected state can be found, outputting an indication that the computer program is in the infected state.

Claim 35

Dependent Claim 25 words

The method as recited in claim 32, wherein the output indication is provided in a form suitable for alerting a user of a computer system.

Claim 36

Dependent Claim 28 words

The method as recited in claim 32, wherein the output indication is provided in a form suitable to be used by an automatic procedure, such as anti-virus software.

Annuity Stage	Window Opens	Payment Deadline	Surcharge Period Until	Estimated Fee	Status
3.5 Years (Year 4)	2000-03-17	2000-09-16	2001-03-18	$2000.00	Window Closed / Lapsed
7.5 Years (Year 8)	2004-03-17	2004-09-16	2005-03-18	$3760.00	Window Closed / Lapsed
11.5 Years (Year 12)	2008-03-17	2008-09-16	2009-03-18	$7700.00	Window Closed / Lapsed

Generic disinfection of programs infected with a computer virus

Abstract

Inventors

Bibliographic Details

Claims Analysis

References Cited (Backward Citations)

USPTO Annuity & Maintenance Windows

Assigned Categories & Tags

Assign Category Tag