Method for recovery of a computer program infected by a computer virus

• US 5,349,655 A
• Filed: 05/12/1992
• Issued: 09/20/1994
• Est. Priority Date: 05/24/1991
• Status: Expired due to Fees

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Mann, Omri
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): LE, DIEU MINH T
• Application Number:
  US07/881,859
• Time in Patent Office: 861 Days
• Field of Search: 395/575, 380/4, 380/24, 380/25, 371/14, 371/19, 371/67.1
• US Class Current: 714/6.31
• CPC Class Codes: G06F 11/1402 Saving, restoring, recovering or retrying
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files

Abstract

A recovery technique allows a computer program to be recovered from a program which has been infected with a computer virus. Prior to the program being infected, a unique fingerprint of the program is taken and stored along with data relating to the beginning portion of the program at a location separate from the program. A program thought to be infected is processed by generating a fingerprint of a string in the program utilizing the stored data. The fingerprint that is generated is compared with the stored fingerprint to determine whether or not the two fingerprints match. If the fingerprints match, the program is restored from the stored information and the string. If the fingerprints do not match, the value utilized to select the string can be incremented and the process repeated.

Claims

1. A method of restoring a computer program infected by a computer virus comprising:

(a) generating a unique fingerprint for a computer program prior to said computer program being infected;

(b) generating a first string which is a transitive function of a first plurality of substrings of said computer program said function having an inverse function for calculating an unknown input given all other inputs and a value of the function;

(c) storing said unique fingerprint and said first string prior to said computer program being infected at a separate location;

(d) generating a substring of said computer program from said first string and said computer program by utilizing said inverse function;

(e) generating a fingerprint of a second string formed of a second plurality of substrings of said computer program and a trial substring generated from said computer program and said first string;

(f) comparing the fingerprint generated in step e) with the fingerprint saved at step c) and determining that said computer program can be restored if said fingerprints match;

(g) restoring said computer program as said second plurality of substrings and said trial substring if said comparison in step f) determines that restoration is possible.

2. The method according to claim 1 where said transitive function is an exclusive OR.

3. The method according to claim 1 where said transitive function is a sum.

4. The method according to claim 1 wherein said fingerprint comprises an error detecting code for said computer program.

5. The method according to claim 4 wherein said error detecting code is a cyclic redundancy check.

6. The method according to claim 4 wherein said error detecting code is a checksum.

7. The method according to claim 4 wherein said error detecting code is an exclusive-OR of words in said computer program.