System for creating virus diagnosing mechanism, method of creating the same, virus diagnosing apparatus and method therefor

• US 5,881,151 A
• Filed: 07/20/1994
• Issued: 03/09/1999
• Est. Priority Date: 11/22/1993
• Status: Expired due to Fees

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Yamamoto, Takashi
• Primary Examiner(s): Banankhah, Majid A.
• Application Number:
  US08/278,051
• Time in Patent Office: 1,693 Days
• Field of Search: 380/4, 380/25, 364/550, 395/700, 395/706, 395/707, 395/708
• US Class Current: 726/24
• CPC Class Codes: G06F 21/565 by checking file integrity

Abstract

When a source program is, by a compiler, translated to an object program that can be executed by a computer, a diagnostic object generating portion provided as one function of the compiler generates a virus diagnosing portion in the object program. The virus diagnosing portion performs a verification of the program size, verification of a checksum, verification of revision information such as date of creation, verification of the disk address, verification of the object program and the verification of the object program using compression and decompression.

Claims

1. A system for creating a virus diagnosing mechanism comprising:

a compiler that translates a source program into an object program executable by a computer; and

a diagnostic object generator that operates in conjunction with said compiler to generate a virus diagnosing portion, at the time of compiling the source program, adapted to detect a virus in said object program, integrated with said object program at the time of compiling.

2. A system according to claim 1, wherein said virus diagnosing portion generated by said diagnostic object generating portion comprises:

an original size storage portion in which an original size of said object program, detected when said object program is translated by said compiler, is stored;

an execution size detection portion for detecting a size of said object program when said object program is loaded as an operating system or a program by said computer; and

a size discriminating portion that compares said original size and said execution size when said object program is executed and allows the execution to continue if said two sizes coincide with each other and interrupts the execution if said two sizes do not coincide with each other.

3. A system according to claim 1, wherein said virus diagnosing portion generated by said diagnostic object generating portion comprises:

an original checksum storage portion in which an original checksum of said object program, detected when said object program is translated by said compiler, is stored;

a checksum detection portion for detecting a checksum of said object program when said object program is loaded as an operating system or a program by said computer; and

a checksum discriminating portion that compares said original checksum and said checksum when said object program is executed and allows the execution to continue if said two checksums coincide with each other and interrupts the execution if said two checksums do not coincide with each other.

4. A system according to claim 1, wherein said virus diagnosing portion generated by said diagnostic object generating portion comprises:

an original revision storage portion in which original revision information of said object program, detected when said object program is translated by said compiler, is stored;

a revision detection portion for detecting revision information of said object program when said object program is loaded as an operating system or a program for said computer; and

a revision discriminating portion that compares said original revision information and said revision information and allows the execution to continue if said two revision information items coincide with each other and interrupts the execution if said two revision information items do not coincide with each other.

5. A system according to claim 4, wherein

said original revision information comprises at least one of a date of creation including updating, a time of creation including updating, a name of creator, a name of program and a version number.

6. A system according to claim 1, wherein said virus diagnosing portion generated by said diagnostic object generating portion comprises:

a disk address storage portion in which an original disk address indicating the place, in which said object program translated by said compiler is stored, is stored;

a disk address detection portion for detecting a disk address of said object program when said object program is loaded as an operating system or a program by said computer; and

a disk address comparison portion that compares said original disk address and said disk address when said object program is executed and allows the execution to continue if said two disk addresses coincide with each other and interrupts the execution if said two disk addresses do not coincide with each other.

7. A system according to claim 1, wherein said virus diagnosing portion generated by said diagnostic object generating portion comprises:

an original object storage portion in which a copy of said object program as translated by said compiler is stored;

an execution object reading portion for reading said copy of said object program when said object program is loaded as an operating system or a program by said computer; and

an object comparison portion that compares said object program and said copy of said object program when said object program is executed and allows the execution to continue if said two objects coincide with each other and interrupts the execution if said two objects do not coincide with each other.

8. A system according to claim 1, wherein said virus diagnosing portion generated by said diagnostic object generating portion comprises:

a compressed object storage portion in which a compressed copy of said object program is stored;

an execution object reading portion for reading said compressed copy of said object program when said object program is loaded as an operating system or a program by said computer;

a restoring portion for decompressing said compressed object program; and

an object comparison portion that compares said decompressed object program and said object program when said object program is executed and allows the execution to continue if said two objects coincide with each other and interrupts the execution if said two objects do not coincide with each other.

9. A system according to any one of claim 2, wherein said virus diagnosing portion generated by said diagnostic object generating portion further comprises an updating inhibition portion for inhibiting rewriting of said program due to execution of said object program.

10. A method of creating a virus diagnosing mechanism comprising:

translating a source program into an object program that can be executed by a computer; and

concurrently with compiling, generating a virus diagnosing portion, at the time of compiling the source program adapted to detect a virus, in said object program integrated with said object program.

11. A method according to claim 10, wherein said virus diagnosing portion comprises:

an original size storage process which an original size of said object program, detected when said object program is stored;

an execution size detection process for detecting size of said object program when said object program is loaded as an operating system or a program by said computer; and

a size discriminating process in which said original size and said execution size are compared when said object program is executed and allows the process to continue if said two sizes coincide with each other nd interrupts the process execution if said two sizes do not coincide with each other.

12. A method according to claim 10, wherein said virus diagnosing portion comprises:

an original checksum storage process in which an original checksum of said object program, detected when said object program is compiled;

a checksum detection process for detecting a checksum of said object program when said object program is loaded as an operating system or a program by said computer; and

a checksum discriminating process in which said original checksum and said checksum are compared when said object program is executed and allows the process execution to continue if said two checksums coincide with each other and interrupts the process execution if said two checksums do not coincide with each other.

13. A method according to claim 10, wherein said virus diagnosing portion comprises:

an original revision storage portion in which original revision information of said object program, detected when said object program is stored;

a revision detection process for detecting revision information of said object program when said object program is loaded as an operating system or a program by said computer; and

a revision discriminating process in which said original revision information and said revision information is compared and allows the process execution to continue if said two revision information items coincide with each other and interrupts the process execution if said two revision information items do not coincide with each other.

14. A system according to claim 13, wherein at least said original revision information comprises at least one of a date of creation including updating, a time of creation including updating, a name of creator, a name of program and a version number.

15. A method according to claim 10, wherein said virus diagnosing portion comprises:

a disk address storage process in which an original disk address indicating the place, in which said object program is stored;

a disk address detection process for detecting a disk address of said object program when said object program is loaded as an operating system or a program by said computer; and

a disk address comparison process in which said original disk address and said disk address are compared when said object program is executed and allows the process execution to continue if said two disk addresses coincide with each other and interrupts the process execution if said two disk addresses do not coincide with each other.

16. A method according to claim 10, wherein said virus diagnosing portion comprises:

an original object storage process in which a copy of said object program is stored;

an execution object reading process for reading said copy of said object program when said object program is loaded as an operating system or a program by said computer; and

an object comparison process which compares said object program and said copy of said object program when said object program is executed and allows the execution to continue if said two objects coincide with each other and interrupts the process execution if said two objects do not coincide with each other.

17. A system according to claim 10, wherein

said virus diagnosing portion comprises:

a compressed object storage process in which a compressed copy of said object program is stored;

an execution object reading process for reading said compressed copy of said object program when said object program is loaded as an operating system or a program by said computer;

a restoring process for decompressing said compressed object program; and

an object comparison process which compares said decompressed object program and said object program when said object program is executed and allows the execution to continue if said two objects coincide with each other and interrupts the process execution if said two objects do not coincide with each other.

18. A method according to any one of claim 11, wherein said virus diagnosing portion generated in said diagnostic object generating process further comprises an updating inhibition process for inhibiting rewriting of said program due to execution of said object program.

19. An object program, produced by a compiler, that can be loaded in a computer and executed as an operating system or a program, comprising:

a reference information detection portion for generating reference information when said object program is compiled from source code, said reference information used to diagnose a virus in said object program;

an execution information detection portion for detecting execution information which is used for virus diagnosis when said object program is loaded as an operating system or a program by said computer; and

a discriminating portion that compares said reference information and said execution information when said object program is executed and allows the execution of said object program to continue if both of said information items coincide with each other and interrupts the execution if both of said information items differ.

20. An apparatus according to claim 19, wherein said reference information original size storage portion in which an original size of said object program

and said execution information comprises a size of said object program when said object program is loaded as an operating system or a program for said computer.

21. An apparatus according to claim 19, wherein said reference information comprises an original checksum of said object program and said execution information comprises a

checksum of said object program when said object program is loaded as an operating system or a program for said computer.

22. An apparatus according to claim 19, wherein said reference information comprises original revision information of said object program

and said execution information comprises revision information of said object program when said object program is loaded as an operating system or a program for said computer.

23. An apparatus according to claim 22, wherein said revision information comprises at least one of a date of creation including updating, a time of creation including updating, a name of creator, a name of program and a version number.

24. An apparatus according to claim 19, wherein said reference information comprises a disk address indicating the place in which said object program translated by said compiler is stored and said execution information comprises a

disk address of said object program when said object program is loaded as an operating system or a program for said computer.

25. An apparatus according to claim 19, wherein said reference information comprises a copy of said object program

and said execution information comprises said object program when said object program is loaded as an operating system or a program for said computer.

26. An apparatus according to claim 19, wherein said reference information comprises a restored copy of a compressed copy of said object program;

execution object reading portion for reading and said execution information comprises said object program when said object program is loaded as an operating system or a program for said computer.

27. An apparatus according to any one of claim 20, wherein said virus diagnosing portion further comprises an updating inhibition portion for inhibiting rewriting of said program due to execution of said object program.

28. A virus diagnosing method for diagnosing an object program executed by a computer as an operating system or a program, comprising:

a reference information detection process for generating reference information when said object program is compiled from source code;

an execution information detecting process for detecting execution information which is used for virus diagnosis when said object program is loaded as an operating system or a program by said computer; and

a discriminating process which compares said reference information and said execution information when said object program is executed and allows the execution of said object program to continue if both of said information items coincide with each other and interrupts the execution if both of said information items differ.

29. A method according to claim 28, wherein said reference information comprises

an original size of said object program

and said execution information comprises a size of said object program when said object program is loaded as an operating system or a program by said computer.

30. A method according to claim 28, wherein said reference information comprises

an original checksum of said object program

and said execution information comprises a checksum of said object program when said object program is loaded as an operating system or a program by said computer.

31. A method according to claim 28, wherein said reference information comprises an original revision information of said object program

and said execution information comprises revision information of said object program when said object program is loaded as an operating system or a program by said computer.

32. A method according to claim 31, wherein said revision information comprises at least one of a date of creation including updating, a time of creation including updating, a name of creator, a name of program and a version number.

33. A method according to claim 28, wherein said reference information comprises a disk address indicating the place, in which said object program is stored

and said execution information comprises a disk address of said object program when said object program is loaded as an operating system or a program by said computer.

34. A method according to claim 28, wherein said reference information comprises a copy of said object program

and said execution information comprises said object program when said object program is loaded as an operating system or a program by said computer.

35. A method according to claim 28, wherein said reference information comprises a decompressed copy of a compressed copy of said object program

and said execution information comprises said object program when said object program is loaded as an operating system or a program by said computer.

36. A method according to any one of claims 28, wherein said virus diagnosing process further comprises an updating inhibition process for inhibiting rewriting of said program due to execution of said object program.

37. A program, stored on a computer readable medium for execution on a general purpose computer, comprising:

an object section which performs a main function of the program to provide a service to a user;

a virus diagnosing section, created at the time the program was compiled and integrated with said object program, which, when said program is called, checks said object section, prior to execution, for viruses.