US5684875A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for detecting a computer virus on a computer
Assignee: Individual
•
Filing: 1994-10-21
•
Granted: 1997-11-04
•
Expires: 2014-10-21
Abstract
Abstract Methods and apparatus for detecting a computer virus on a computer, by means of repeated execution of detection algorithms to detect presence of a virus. A multitude of detection algorithms are provided, and each time the computer is checked, at least one of the algorithms is selected and executed. Even if a virus could not be detected by a few of these detection algorithms, such a virus still has only very limited chances to survive because it will be detected by another algorithm. The invention gains additional security due to at least one detection algorithm which at some suitable instant compares the total of occupied and/or free random access memory with nominal values valid at that instant. Another embodiment includes at least one detection algorithm that provides special secure disk access functions to the operating system which are not publicly documented and which require additional parameters that must match their nominal values in order to enable the function. As a further security measure, the selected virus detection algorithms can be encrypted, and only decrypted when executed in RAM, the decrypted portions immediately deleted from RAM after execution.
Inventors
- 👤 Hans Ellenberger
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 14:15
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/566; G06F21/562; G06F21/565
Claims Analysis
Total Claims: 21
Claim 1
Independent Claim
58 words
A method to detect a computer virus on a computer comprising: providing a multitude of available algorithms for detecting presence of a virus; electronically selecting on a substantially random basis at least one algorithm from said multitude of virus detection algorithms; and repeatedly checking for presence of a virus by executing at least one of said selected algorithms.
Claim 2
Independent Claim
58 words
A method to detect a computer virus on a computer comprising: providing a multitude of available algorithms for detecting presence of a virus; electronically selecting on a substantially random basis at least one algorithm from said multitude of virus detection algorithms; and repeatedly checking for presence of a virus by executing at least one of said selected algorithms.
Claim 3
Dependent Claim
81 words
A method as recited in claim 1 including selecting on a substantially random basis at least one detection algorithm that performs checks of at least one of the following: any executable programs or parts thereof which are executed before an operating system program is executed on the computer; any executable programs or parts thereof which constitute the operating system of that computer; and any executable programs or parts thereof which are not a part of the operating system of the computer.
Claim 4
Dependent Claim
38 words
A method as recited in claim 1 including selecting on a substantially random basis at least two different detection algorithms, each with randomly selected parameters, that perform checks of some or all executable code of the computer system.
Claim 5
Dependent Claim
79 words
A method as recited in claim 1 including selecting on a substantially random basis at least one detection algorithm that performs checks of at least one of the following: the size of files containing executable programs by comparing the size of a particular file with a predetermined nominal value of the size of that particular file; and the date of last modification of files containing executable programs by comparing those dates with a predetermined nominal value of the date.
Claim 6
Dependent Claim
64 words
A method as recited in claim 1 including selecting on a substantially random basis at least one algorithm which includes: selecting the proper instant to examine the RAM; examining the RAM to determine a figure for one or more of: the free RAM, the occupied RAM, and the total of free and occupied RAM; and comparing the figure thus obtained to predetermined nominal values.
Claim 7
Dependent Claim
52 words
A method as recited in claim 1 including selecting on a substantially random basis at least one detection algorithm that performs special calls of the operating system which are not publicly documented and which require additional parameters that must match their predetermined nominal values in order to enable execution of the call.
Claim 8
Dependent Claim
38 words
A method as recited in claim 1 including selecting on a substantially random basis at least one detection algorithm that is stored in encrypted form and kept in RAM as an unencrypted, executable program only during its execution.
Claim 9
Dependent Claim
26 words
A method as recited in claim 2 wherein said multitude of detection algorithms can be grouped according to the amount of time required for their execution.
Claim 10
Independent Claim
95 words
A method to detect a computer virus on a computer equipped with mass storage and memory not alterable by virus, comprising: providing a multitude of algorithms for detecting presence of a virus; electronically selecting on a substantially random basis at least one algorithm from said multitude of virus detection algorithms; and repeatedly executing at least one of said selected algorithms; at least one of the selected algorithms being of a type that, in order to read information stored in the mass storage, makes calls directly to appropriate locations of code stored in the non-alterable memory.
Claim 11
Independent Claim
95 words
A method to detect a computer virus on a computer equipped with mass storage and memory not alterable by virus, comprising: providing a multitude of algorithms for detecting presence of a virus; electronically selecting on a substantially random basis at least one algorithm from said multitude of virus detection algorithms; and repeatedly executing at least one of said selected algorithms; at least one of the selected algorithms being of a type that, in order to read information stored in the mass storage, makes calls directly to appropriate locations of code stored in the non-alterable memory.
Claim 12
Dependent Claim
48 words
A method as recited in claim 9 further comprising: investigating the location of certain code in the non-alterable memory which performs reading and writing of the mass storage; and executing directly to the location of that code any later calls to read and write to the mass storage.
Claim 13
Independent Claim
59 words
An apparatus for detecting a computer virus on a computer comprising, in combination: a multitude of available algorithms for detecting presence of a virus; means for electronically selecting on a substantially random basis at least one algorithm from said multitude of virus detection algorithms; and means for repeatedly executing said selected algorithms, thereby repeatedly checking for presence of virus.
Claim 14
Independent Claim
59 words
An apparatus for detecting a computer virus on a computer comprising, in combination: a multitude of available algorithms for detecting presence of a virus; means for electronically selecting on a substantially random basis at least one algorithm from said multitude of virus detection algorithms; and means for repeatedly executing said selected algorithms, thereby repeatedly checking for presence of virus.
Claim 15
Independent Claim
70 words
A method to detect a computer virus on a computer having RAM, comprising: selecting the proper instant to examine the RAM; examining the RAM to determine a figure based upon one or more of the following criteria: the free RAM, the occupied RAM, and the total of free and occupied RAM, the criteria being selected on a substantially random basis: and comparing the figure thus obtained to predetermined nominal values.
Claim 16
Independent Claim
70 words
A method to detect a computer virus on a computer having RAM, comprising: selecting the proper instant to examine the RAM; examining the RAM to determine a figure based upon one or more of the following criteria: the free RAM, the occupied RAM, and the total of free and occupied RAM, the criteria being selected on a substantially random basis: and comparing the figure thus obtained to predetermined nominal values.
Claim 17
Independent Claim
75 words
A method to detect a computer virus on a computer comprising: providing a multitude of available algorithms for detecting presence of a virus including a detection algorithm that is stored in encrypted form and kept in RAM as an unencrypted, executable program only during its execution; electronically selecting according to preestablished criteria the detection algorithm from said multitude of virus detection algorithms; and repeatedly checking for presence of a virus by executing the detection algorithm.
Claim 18
Independent Claim
75 words
A method to detect a computer virus on a computer comprising: providing a multitude of available algorithms for detecting presence of a virus including a detection algorithm that is stored in encrypted form and kept in RAM as an unencrypted, executable program only during its execution; electronically selecting according to preestablished criteria the detection algorithm from said multitude of virus detection algorithms; and repeatedly checking for presence of a virus by executing the detection algorithm.
Claim 19
Dependent Claim
21 words
A method as recited in claim 13 wherein, in the selecting step, the preestablished criteria is on a substantially random basis.
Claim 20
Independent Claim
75 words
A method to detect a computer virus on a computer comprising: providing a multitude of available algorithms for detecting presence of a virus, said multitude of detection algorithms being grouped according to the amount of time required for their execution, electronically selecting on a substantially random basis at least one algorithm from said multitude of virus detection algorithms; and repeatedly checking for presence of a virus by executing at least one of said selected algorithms.
Claim 21
Independent Claim
75 words
A method to detect a computer virus on a computer comprising: providing a multitude of available algorithms for detecting presence of a virus, said multitude of detection algorithms being grouped according to the amount of time required for their execution, electronically selecting on a substantially random basis at least one algorithm from said multitude of virus detection algorithms; and repeatedly checking for presence of a virus by executing at least one of said selected algorithms.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2000-11-03 | 2001-05-05 | 2001-11-04 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2004-11-03 | 2005-05-05 | 2005-11-04 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2008-11-03 | 2009-05-05 | 2009-11-04 | $7700.00 | Window Closed / Lapsed |