Virus protection in computer systems

• US 5,802,277 A
• Filed: 07/26/1996
• Issued: 09/01/1998
• Est. Priority Date: 07/31/1995
• Status: Expired due to Fees

• Current Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Cowlard, James
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Elmore, Stephen C.
• Application Number:
  US08/686,897
• Time in Patent Office: 767 Days
• Field of Search: 395/186, 395/183.13, 395/183.12, 395/183.14, 380/3, 380/4, 364/222.5, 364/286.4, 364/918.7
• US Class Current: 726/22
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

A method and apparatus for preventing the virus infection of computer systems from a diskette carrying a boot sector virus. System ROM code in the computer system includes a routine that is executed before passing control to a bootable media. This routine is designed to execute when Power On Self Test has completed and the boot record from the bootable media, either hardfile or diskette, has been loaded into system memory. The boot record is scanned for the presence of known boot sector viruses, signatures of which are stored in FLASH ROM within the computer system.

Claims

1. A method for preventing the transfer of boot sector viruses to a computer system having a processor and memory in which is stored system microcode that is executed by the processor to initialize the system on system power-up and in which is further stored virus detection code, the system being operable after the system initialization to load a system boot program from a removable bootable media, the method comprising:

upon completion of system initialization, loading the boot program from the removable bootable media into system memory;

prior to execution of said boot program, executing said virus detection code to check said stored boot program for the presence of computer viruses, wherein the system memory includes virus signature data in addition to the virus detection code, said step of executing the virus detection code includes comparing the stored boot program with the virus signature data; and

issuing a warning to the user of the computer system on a determination that the boot program includes a computer virus.

2. A method as claimed in claim 1, wherein the virus signature data comprises a sequence of bytes indicative of a particular computer virus and the step of comparing the boot program with the virus signature data comprises scanning the bytes of the boot record for the presence of said sequence of bytes of said virus signature data.

3. A method as claimed in claim 1, wherein said removable bootable medium is a diskette in a diskette drive of said system, the step of loading the boot program into system memory comprises transferring, into system memory, the boot program stored on said diskette.

4. A method as claimed in claim 1, comprising the further step of halting execution of the boot program on detection of a computer virus.

5. A computer system comprising a processor and read-only memory for storing system microcode that is executed by the processor to initialize the system on system power-up and for further storing virus detection code, the system being operable, on completion of the initialization procedure to load a boot program from a removable bootable medium into system memory, the system being further operable, prior to execution of the loaded boot program, to check, by means of the virus detection code executing on said processor, the boot program for computer viruses, the system memory further storing virus signature data, wherein the system is operable, by means of the virus detection code executing on the system processor, to compare the loaded boot program with the virus signature data in order to determine the presence of a computer virus, and the system being further operable to issue a warning to a user of the computer system on a determination that the computer virus has been detected.

6. A computer system as claimed in claim 5, wherein said read-only memory is programmable read only memory.

7. A computer system as claimed in claim 5, wherein said removable bootable medium is a diskette drive.

8. A computer system as claimed in claim 5, wherein said read-only memory is a FLASH ROM.