Repairing alterations to computer files
First Claim
1. A computer program product comprising a computer program operable to control a computer to reverse an alteration to a stored computer file, said computer program comprising:
- file comparing logic operable to compare said stored computer file with an archive copy of said computer file stored when said stored computer file was created; and
alteration reversal logic operable if said file comparing logic detects that said stored computer file and said archive computer file do not match to replace said stored computer file with said archive copy of said computer file.
2 Assignments
0 Petitions
Accused Products
Abstract
Archive copies of active computer files are generated and stored when a computer file is created or copied onto a computer system. These archive copies are compared with the current active copies upon subsequent access to detect malicious alterations in the active copies. If such alterations are detected, then a repair of the active copy may be made by replacing it with the archived copy. This replacement may be subject to user confirmation or user defined rules. The technique may be selectively applied to certain file types, such as executable files or dynamic link libraries, that are known to infrequently change during normal use.
-
Citations
27 Claims
-
1. A computer program product comprising a computer program operable to control a computer to reverse an alteration to a stored computer file, said computer program comprising:
-
file comparing logic operable to compare said stored computer file with an archive copy of said computer file stored when said stored computer file was created; and
alteration reversal logic operable if said file comparing logic detects that said stored computer file and said archive computer file do not match to replace said stored computer file with said archive copy of said computer file. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A method of detecting a malicious alteration to a stored computer file, said method comprising the steps of:
-
comparing said stored computer file with an archive copy of said computer filestored when said stored computer file was created; and
if said file comparing step detects that said stored computer file and said archive computer file do not match, replacing said stored computer file with said archive copy of said computer file. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18, 20, 21, 22, 23, 24, 25, 26, 27)
-
-
19. Apparatus for processing data operable to detect an alteration to a stored computer file, said apparatus comprising:
-
a file comparitor operable to compare said stored computer file with an archive copy of said computer file stored when said stored computer file was created; and
a comparison responder operable if said file comparing logic detects that said stored computer file and said archive computer file do not match to replace said stored computer file with said archive copy of said computer file.
-
Specification