US5826013A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Polymorphic virus detection module
Assignee: Gen Digital Inc
•
Filing: 1997-01-08
•
Granted: 1998-10-20
•
Expires: 2017-01-08
Abstract
Abstract A Polymorphic Anti-virus Module (PAM) (200) comprises a CPU emulator (210) for emulating the target program, a virus signature scanning module (250) for scanning decrypted virus code, and an emulation control module (220), including a static exclusion module (230), a dynamic exclusion module (240), instruction/interrupt usage profiles (224) for the mutation engines (162) of the known polymorphic viruses (150), size and target file types (226) for these viruses, and a table (228) having an entry for each known polymorphic virus (150). During emulation, the emulation control module (220) may observe use of a register-indirect memory write instruction using a register that has not been initialized. Such a random write can be used as an indication that the file is probably a data file and so is unlikely to harbor a virus.
Inventors
- 👤 Carey S. Nachenberg
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 11:41
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/564; G06F21/566
Claims Analysis
Total Claims: 10
Claim 1
Independent Claim
67 words
A computer-implemented method for detecting computer viruses in a computer file, the method comprising: determining whether an instruction is a register-indirect memory write, which writes to a memory address specified by the contents of a register; determining whether the register is uninitialized if the instruction is a register-indirect memory write; and excluding from consideration those viruses that cannot perform register-indirect memory writes if the register is uninitialized.
Claim 2
Dependent Claim
67 words
A computer-implemented method for detecting computer viruses in a computer file, the method comprising: determining whether an instruction is a register-indirect memory write, which writes to a memory address specified by the contents of a register; determining whether the register is uninitialized if the instruction is a register-indirect memory write; and excluding from consideration those viruses that cannot perform register-indirect memory writes if the register is uninitialized.
Claim 3
Dependent Claim
16 words
The computer-implemented method of claim 1, further comprising: setting a flag if the register is initialized.
Claim 4
Dependent Claim
20 words
The computer-implemented method of claim 2, wherein determining whether the register is uninitialized comprises determining whether the flag is set.
Claim 5
Dependent Claim
13 words
The computer-implemented method of claim 1, wherein the register is an index register.
Claim 6
Dependent Claim
13 words
The computer-implemented method of claim 1, wherein the register is a base register.
Claim 7
Independent Claim
85 words
A system for detecting computer viruses in a computer file, the system comprising: a register; an emulation control module for determining whether an instruction is a register indirect memory write, which writes to a memory address specified by the contents of a register; determining whether the register is uninitialized if the instruction is a register-indirect memory write; and excluding from consideration those viruses that cannot perform register-indirect memory writes if the register is uninitialized; and a CPU emulator for simulating instructions of the computer file.
Claim 8
Independent Claim
85 words
A system for detecting computer viruses in a computer file, the system comprising: a register; an emulation control module for determining whether an instruction is a register indirect memory write, which writes to a memory address specified by the contents of a register; determining whether the register is uninitialized if the instruction is a register-indirect memory write; and excluding from consideration those viruses that cannot perform register-indirect memory writes if the register is uninitialized; and a CPU emulator for simulating instructions of the computer file.
Claim 9
Dependent Claim
94 words
A computer program product comprising a computer-usable medium having a computer-readable code embodied therein for detecting computer viruses in a computer file, comprising: computer-readable program code devices configures to determine whether an instruction is a register-indirect memory write, which writes to a memory address specified by the contents of a register; computer-readable program code devices configured to determine whether the register is uninitialized if the instruction is a register-indirect memory write; and computer-readable program code devices configured to exclude from consideration those viruses that cannot perform register-indirect memory writes if the register is uninitialized.
Claim 10
Dependent Claim
94 words
A computer program product comprising a computer-usable medium having a computer-readable code embodied therein for detecting computer viruses in a computer file, comprising: computer-readable program code devices configures to determine whether an instruction is a register-indirect memory write, which writes to a memory address specified by the contents of a register; computer-readable program code devices configured to determine whether the register is uninitialized if the instruction is a register-indirect memory write; and computer-readable program code devices configured to exclude from consideration those viruses that cannot perform register-indirect memory writes if the register is uninitialized.
References Cited (Backward Citations)
US5321840A
Cited
US5144660A
Cited
US5121345A
Cited
US4975950A
Cited
US5319776A
Cited
US5408642A
Cited
US5349655A
Cited
US5511163A
Cited
US5649095A
Cited
US5421006A
Cited
US5359659A
Cited
US5440723A
Cited
US5398196A
Cited
EP0636977A2
Cited
US5675711A
Cited
US5537540A
Cited
US5684875A
Cited
US5442699A
Cited
US5485575A
Cited
US5613002A
Cited
US5559960A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-10-19 | 2002-04-20 | 2002-10-20 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-10-19 | 2006-04-20 | 2006-10-20 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-10-19 | 2010-04-20 | 2010-10-20 | $7700.00 | Window Closed / Lapsed |