Mcafee, Inc.

Networks Associates Technology, Inc.

Michael Kenneth Glover

Mark David Harris

Daniel Joseph Wolff

When a file is created on a computer, an archive copy of that file is also created and separately stored. Upon a subsequent access to the active copy of that file, a comparison between the active copy and the full archived copy is made to detect any changes. If there are not any changes, then the active copy of the file is assumed to be clean from malicious alteration and the access request is permitted. If an alteration has been made and is detected, then further countermeasures are triggered, such as full virus scanning of that file or blocking of its use. This archiving and comparison technique may be selectively applied to a subset of file types, such as executable files and dynamic link libraries, which are known to be infrequently modified during normal user operations.

Detecting malicious alteration of stored computer files

Anti-virus state information for a file is stored within an associated data structure that is created and/or maintained by the file system of the computer. The data structure can be a file directory entry with the anti-virus state information being stored in unused fields of the entry. For file systems that maintain separate entities for the data and resource information of a file, the anti-virus state information can be stored in the resource entity or in a specifically created entity.

Growing community of inventors

Bournemouth, United Kingdom

Michael Kenneth Glover