Software virus detection methods, apparatus and articles of manufacture

• US 20030145213A1
• Filed: 01/30/2002
• Published: 07/31/2003
• Est. Priority Date: 01/30/2002
• Status: Active Grant

• Current Assignee: Cybersoft, Inc.
• Original Assignee: Cybersoft, Inc.
• Inventors: Carbone, Kevin J.
• Granted Patent: US 7,363,506 B2
• Time in Patent Office: Days
• US Class Current: 713/188
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files

Abstract

Methods, apparatus and articles of manufacture for identifying, authenticating and securing code through proscribed code detection and deletion are shown. The preferred embodiments provide for scanning code to determine the presence of proscribed code and then transmitting the code to a file reconstructor upon the detection of proscribed code. At the file reconstructor, templates of the specific document type are used to provide the document file structure, and so delete with precision the proscribed code from the original code.

Claims

1. A proscribed code detection method, comprising the steps of:

locating proscribed code within a file;

selecting a template for said file according to said file type;

applying said template to said file;

reconstructing said file by means of said template; and

,

modifying at least part of said file containing said proscribed code.

2. A method as in claim 1 further comprising the step of intercepting said file as it is transmitted through a communication channel.

3. A method as in claim 1 wherein the step of locating proscribed code within a file further comprises locating said proscribed code using a proscribed code scanner.

4. A method as in claim 1 wherein the step of selecting a template for said file further comprises the step of selecting a template from a predefined group of templates.

5. A method as in claim 1 wherein the step of selecting a template for said file according to said file type further comprises the steps of:

determining the file type; and

,

selecting a file template for said file type.

6. A method as in claim 5 wherein the step of determining the file type further comprises determining the file type from information contained within the file.

7. A method as in claim 1 wherein the templates are selected from the group comprising:

Word file, Excel file, PowerPoint file, Executable file, Command file, or OLE file.

8. A method as in claim 1 wherein the step of modifying at least part of said file containing said proscribed code further comprises deleting said at least part of said file containing said proscribed code.

9. A method as in claim 8 wherein the step of deleting said at least part of said file containing said proscribed code further comprises deleting at least some of the macro part of said file.

10. A method as in claim 1 further comprising the step of implementing said method on a first platform, for scanning said code that is generated by a second platform.

11. The method as in claim 11 wherein said first platform is UNIX.

12. The method of claim 11 wherein said second platform is Windows.

13. A method for detecting proscribed code, comprising the steps of scanning code for the presence of proscribed code, and if proscribed code is found, transmitting said code to a file reconstructor, whereby said file reconstructor reconstructs said code according to a template, and, modifies said code.

14. A proscribed code identification method, comprising the steps of:

locating proscribed code within a file;

selecting a template for said file according to said file type;

applying said template to said file;

reconstructing said file by means of said template; and

,

identifying at least part of said file containing said proscribed code.

15. An apparatus for the detection of proscribed code, comprising:

means for locating proscribed code within a file;

means for selecting a template for said file according to said file type;

means for applying said template to said file;

means for reconstructing said file by means of said template; and

,

means for modifying at least part of said file containing said proscribed code.

16. An apparatus for the detection of proscribed code as in claim 15 whereby said means for modifying at least part of said file containing said proscribed code further comprising means for deleting at least part of said file.

17. An apparatus for the detection of proscribed code comprising:

a proscribed code scanner;

a file reconstructor;

at least one template;

whereby said proscribed code scanner reviews code for the presence of proscribed code, and upon locating proscribed code, transmits said code to a file reconstructor, which applies said at least one template to said code in order to identify the location of said proscribed code.

18. An apparatus for the deletion of proscribed code comprising:

a proscribed code scanner;

a file reconstructor;

at least one template;

whereby said proscribed code scanner reviews code for the presence of proscribed code, and upon locating proscribed code, transmits said code to a file reconstructor, which applies said at least one template to said code in order to delete said proscribed code.

20. A template as in claim 18 wherein said predetermined file structure is chosen from the group comprising:

Word file structure, Excel file structure, PowerPoint file structure, Executable file structure, Command file structure, or OLE file structure.

19. A template to be used in a file reconstructor, constructed according to a predetermined file structure.