US5649095A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for detecting computer viruses through the use of a scan information cache
Assignee: McAfee LLC
•
Filing: 1993-10-04
•
Granted: 1997-07-15
•
Expires: 2013-10-04
Abstract
Abstract A method and apparatus is provided for scanning files for computer viruses which use the length of at least one portion (such as a fork) of a file. This length information is stored in a cache. During a scan, the then current size of the file portion is compared to the length stored in the cache and if there is a size difference, the file is then scanned for viruses which can change that portion of the file's size.
Inventors
- 👤 Paul D. Cozza
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 17:06
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/564; G06F21/565; H; H04; H04L; H04L51/00; H04L51/21; H04L51/212
Claims Analysis
Total Claims: 14
Claim 1
Independent Claim
174 words
A method for increasing the speed at which a computer, which has files including more than one fork, scans for the presence of a computer virus, said method comprising the steps of: creating a scan information cache on a non-volatile storage medium; gathering identifying information, which includes at least one length of some portion of a file, about an initial state of said file; storing said identifying information in said scan information cache; gathering current state information, which includes at least one length of some portion of said file, about a current state of said file; determining how said identifying information stored in said scan information cache differs from said current state information thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affect state information of said file in certain characteristic manners; scanning said file for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present.
Claim 2
Independent Claim
174 words
A method for increasing the speed at which a computer, which has files including more than one fork, scans for the presence of a computer virus, said method comprising the steps of: creating a scan information cache on a non-volatile storage medium; gathering identifying information, which includes at least one length of some portion of a file, about an initial state of said file; storing said identifying information in said scan information cache; gathering current state information, which includes at least one length of some portion of said file, about a current state of said file; determining how said identifying information stored in said scan information cache differs from said current state information thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affect state information of said file in certain characteristic manners; scanning said file for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present.
Claim 3
Dependent Claim
68 words
The method for increasing the speed at which a computer, which has files including more than one fork, scans for the presence of a computer virus of claim 1 further comprising the step of scanning files for which said identifying information is not found in said scan information cache for a subset of those viruses which infect said computer, said subset including viruses that can infect said files.
Claim 4
Dependent Claim
67 words
The method for increasing the speed at which a computer, which has files including more than one fork, scans for the presence of a computer virus of claim 1 further comprising the step of updating said scan information cache by placing a specific indicative value in some part of each location in said scan information cache which corresponds to a file in which a virus is found.
Claim 5
Dependent Claim
57 words
The method for increasing the speed at which a computer, which has files including more than one fork, scans for the presence of a computer virus of claim 1 further comprising the step of updating said scan information cache with new information concerning a state of a file for each file in which no virus is found.
Claim 6
Dependent Claim
57 words
The method for increasing the speed at which a computer, which has files including more than one fork, scans for the presence of a computer virus of claim 1 further comprising the step of updating said scan information cache with new information concerning a state of a file for each file in which a virus is found.
Claim 7
Dependent Claim
71 words
The method for increasing the speed at which a computer, which has files including more than one fork, scans for the presence of a computer virus of claim 1 further comprising the step of comparing the difference between said at least one length in said scan information cache for the initial state of said file and said at least one length of said current state of said file to a tolerance.
Claim 8
Independent Claim
180 words
An apparatus that can rapidly scan for the presence of a computer virus on a computer, which has files including more than one fork, said apparatus comprising: a scan information cache on a non-volatile storage medium; means for gathering identifying information, which includes at least one length of some portion of a file, about an initial state of said file: means for storing said identifying information in said scan information cache; means for gathering state information, which includes at least one length of some portion of said file, about a current state of said file; means for determining how said identifying information stored in the scan information cache differs from said current state information for said file thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affect state information of said file in certain characteristic manners; means for scanning said file for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present.
Claim 9
Independent Claim
180 words
An apparatus that can rapidly scan for the presence of a computer virus on a computer, which has files including more than one fork, said apparatus comprising: a scan information cache on a non-volatile storage medium; means for gathering identifying information, which includes at least one length of some portion of a file, about an initial state of said file: means for storing said identifying information in said scan information cache; means for gathering state information, which includes at least one length of some portion of said file, about a current state of said file; means for determining how said identifying information stored in the scan information cache differs from said current state information for said file thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affect state information of said file in certain characteristic manners; means for scanning said file for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present.
Claim 10
Dependent Claim
54 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 7 further comprising means for scanning files for which said identifying information is not found in said scan information cache for a subset of those viruses which infect said computer, said subset including viruses that can infect said files.
Claim 11
Dependent Claim
53 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 7 further comprising means for updating said scan information cache by placing a specific indicative value in some part of each location in said scan information cache which corresponds to a file in which a virus is found.
Claim 12
Dependent Claim
43 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 7 further comprising means for updating said scan information cache with new information concerning a state of a file for each file in which no virus is found.
Claim 13
Dependent Claim
43 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 7 further comprising means for updating said scan information cache with new information concerning a state of a file for each file in which a virus is found.
Claim 14
Dependent Claim
57 words
The apparatus that can rapidly scan for the presence of a computer virus of claim 7 further comprising means for comparing the difference between said at least one length in said scan information cache for the initial state of said file and said at least one length of said current state of said file to a tolerance.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2000-07-14 | 2001-01-13 | 2001-07-15 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2004-07-14 | 2005-01-13 | 2005-07-15 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2008-07-14 | 2009-01-13 | 2009-07-15 | $7700.00 | Window Closed / Lapsed |