Automatic regeneration of computer files

• US 7,685,174 B2
• Filed: 07/08/2004
• Issued: 03/23/2010
• Est. Priority Date: 07/08/2003
• Status: Active Grant

• Current Assignee: Seventh Knight
• Original Assignee: Seventh Knight, Inc. (All-Q-Tell Corp.)
• Inventors: Koestler, Luke
• Primary Examiner(s): Le; Miranda
• Application Number:
  US10/885,638
• Publication Number:
  US 20050120063A1
• Time in Patent Office: 2,084 Days
• Field of Search: 707 1- 10, 707100-102, 707/104.1, 707200-205, 709217-224, 709/229
• US Class Current: 707/682
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures

Abstract

A method for regenerating computer files on a computer system having a computer with an operating system, the method includes receiving an input from a user to specify monitored files, detecting modification of at least one of the monitored files, and replacing the at least one modified monitored file with a backup copy of the at least one modified monitored file.

Claims

1. A computer with an operating system, the computer comprising:

an input receiving device operable to receive an input from a user to specify operative files used by the computer to be monitored, the specified files being a subset of files used by the computer; and

a file regenerator operable to;

verify that the user has provided backup copies of the operative files for replacing the operative files;

monitor the operative files;

compare the operative files with the backup files, or receive messages indicating modifications to the operative files;

detect modification of one of the operative files based on the comparing or one of the received messages while monitoring the operative files;

initiate replacement of the modified operative file with the backup copy of the modified operative file, the replacement of the modified operative file being initiated upon detecting the modification of the operative file regardless of whether the modification is a valid modification;

complete the replacement of the modified operative file with the backup copy of the modified operative file; and

store an indication that the modified operative file is replaced with the backup copy of the modified operative file.

2. The computer of claim 1, comprising:

a service initiator operable to initiate the file regenerator.

3. The computer of claim 2, wherein the file regenerator compares attributes of the operative files and the backup copies.

4. The computer of claim 3, comprising:

a computer registry operable to store the indication in a computer operating system registry when the file regenerator replaces the modified operative file.

5. The computer of claim 3, wherein the monitored operative files are stored in root directories specified by the user.

6. The computer of claim 5, wherein an instance of the file regenerator is initiated for each of the root directories.

7. The computer of claim 6, comprising:

a computer registry operable to store the indication in an operating system registry when the file regenerator replaces the modified operative file.

8. The computer of claim 1, comprising:

a service register operable to register the file regenerator as a file-system object of the operating system.

9. The computer of claim 8, further comprising a message requestor operable to request a copy of any file change messages sent by the operating system.

10. The computer of claim 9, further comprising:

a computer registry operable to store the indication in the registry that the file regenerator has replaced the modified operative file.

11. A computer-readable storage medium containing instructions tangibly recorded on the storage medium, the instructions for causing a computer to perform steps comprising:

receiving an input from a user to specify operative files used by a computer system to be monitored, the specified files being a subset of files used by the computer system;

verifying that the user has provided backup copies of the operative files for replacing the operative files;

monitoring the operative files;

comparing the operative files with the backup files, or receiving messages indicating modifications to the operative files;

detecting modification of one of the operative files based on the comparing or one of the received messages while monitoring the operative files;

initiating replacement of the modified operative file with the backup copy of the modified operative file, the replacement of the modified operative file being initiated upon detecting when the modification of the operative file of whether the modification is a valid modification;

completing the replacement of the modified operative file with the backup copy of the modified operative file; and

storing an indication that the modified operative file is replaced with the backup copy of the modified operative file.

12. The computer-readable storage medium of claim 11, further comprising instructions for:

initiating an instance of a file regeneration service to monitor the operative files upon receiving the user input.

13. The computer-readable storage medium of claim 12, wherein the step of comparing comprises:

comparing attributes of the operative files and the backup copies.

14. The computer-readable storage medium of claim 12, further comprising instructions for:

registering the file regeneration service as a file-system object of the operating system.

15. The computer-readable storage medium of claim 14, wherein the step of detecting further comprises:

requesting a copy of any file change messages sent by an operating system of the computer.

16. The computer-readable storage medium of claim 15, further comprising instructions for:

storing the indication in the registry that the file regeneration service has replaced the modified operative file.

17. The computer-readable storage medium of claim 16, wherein the monitored operative files are stored in root directories specified by the user.

18. The computer-readable storage medium of claim 13, further comprising instructions for:

storing the indication in a computer operating system registry when the file regeneration service replaces the modified operative file.

19. The computer-readable storage medium of claim 13, wherein the monitored operative files are stored in root directories specified by the user.

20. The computer-readable storage medium of claim 19, wherein an instance of the file regeneration service is initiated for each of the root directories.

21. The computer-readable storage medium of claim 20, further comprising instructions for:

storing the indication in a computer operating system registry when the file regeneration service replaces the modified operative file.

22. A computer with an operating system, the computer comprising:

an input device for receiving an input from a user to specify operative files used by a computer system to be monitored, the specified files being a subset of files used by the computer system;

means for verifying that the user has provided backup copies of the operative files for replacing the operative files;

means for initiating an instance of the file regeneration service to monitor the operative files;

means for monitoring the operative files with the file regeneration service;

means for comparing the operative files with the backup files, or receiving messages indicating modifications to the operative files;

means for detecting modification of one of the operative files based on the comparing or one of the received messages while the operative files are being monitored by the file regeneration service;

means for initiating replacement of the modified operative file with the backup copy of the modified operative file, the replacement of the modified operative file being initiated upon detecting when the modification of the operative file regardless of whether the modification is a valid modification;

means for completing the replacement of the modified operative file with the backup copy of the modified operative file; and

means for storing an indication that the modified operative file is replaced with the backup copy of the modified operative file.

23. A computer-implemented method comprising the steps implemented by a computer of:

receiving an input from a user to specify operative files used by a computer system to be monitored by a file regeneration service, the specified files being a subset of files used by the computer system;

verifying that the user has provided backup copies of the operative files for replacing the operative files;

initiating an instance of the file regeneration service to monitor the operative files;

monitoring the operative files with the file regeneration service;

comparing the operative files with the backup files, or receiving messages indicating modifications to the operative files;

detecting modification of one of the operative files based on the comparing or one of the received messages while the operative files are being monitored by the file regeneration service;

initiating replacement of the modified operative file with the backup copy of the modified operative file, the replacement of the modified operative file being initiated upon detecting when the modification of the operative file regardless of whether the modification is a valid modification;

completing the replacement of the modified operative file with the backup copy of the modified operative file; and

storing an indication that the modified operative file is replaced with the backup copy of the modified operative file.

24. The computer-implemented method of claim 23, wherein the file regeneration service is initiated upon receiving the user input.

25. The computer-implemented method of claim 24, wherein the comparing comprises:

comparing attributes of the operative files and the backup copies.

26. The computer-implemented method of claim 25, comprising:

storing the indication in a computer operating system registry when the file regeneration service replaces the modified operative file.

27. The computer-implemented method of claim 25, wherein the operative files are stored in root directories specified by the user.

28. The computer-implemented method of claim 27, wherein an instance of the file regeneration service is initiated for each of the root directories.

29. The computer-implemented method of claim 28, comprising:

storing the indication in a computer operating system registry when the file regeneration service replaces the modified operative file.

30. The computer-implemented method of claim 23, comprising:

registering the file regeneration service as a file-system object of an operating system of the computer.

31. The computer-implemented method of claim 30, wherein detecting further comprises:

requesting a copy of any file change messages sent by the operating system.

32. The computer-implemented method of claim 31, wherein the operating system comprises a registry and the method comprises:

storing the indication in the registry that the file regeneration service has replaced the modified operative file.

33. The computer-implemented method of claim 32, wherein the monitored operative files are stored in root directories specified by the user.

34. The computer-implemented method according to claim 23, further comprising storing a service record including a replacement time indicating when the modified operative file is replaced.

35. The computer-implemented method according to claim 34, wherein the service record includes a detection time indicating when the modification of the monitored operative file is detected.

36. The computer-implemented method according to claim 23, wherein the modification is detected by comparing binary composition of the at least one modified operative file with binary composition of the backup copy.

37. The computer-implemented method according to claim 23, wherein the monitored operative files are compared to the backup copies at predetermined intervals to detect the modification.