Mcafee, Inc.

Viatcheslav Peternev

Igor G Muttik

Dmitry O Gryaznov

Ivan Alexandrovich Teblyashkin

Computer programs are analysed for the occurrence of redundant program instructions of program instruction using uninitialised variables. If the number of such instructions exceeds a threshold level, then the computer program is treated as containing a computer virus. This technique is useful in identifying new and polymorphic viruses.

Heuristic detection of polymorphic computer viruses based on redundancy in viral code

Virus fingerprint data is automatically generated for use in detecting computer viruses and virus removal data for use in removing computer viruses from infected files. The fingerprint generation technique serves to identify the infected virus carrying portions of a computer file and then search within those portions for matching blocks of bytes in excess of a certain size that are consistently located at a predetermined position within the infected computer file such that they may be used to reliably detect that computer virus when it is infecting different host computer files. The removal data generation mechanism serves to search the infected computer file against a clean version of that computer file to identify matching blocks. Critical data missing within the infected computer file may be found within the virus carrying portions by the application of various decryption techniques. Cutting points to remove the virus carrying portions are identified. The fingerprint data and the removal data are tested on pairs of clean and infected computer files to verify that they operate correctly.

Automatic builder of detection and cleaning routines for computer viruses

A macro virus definitions database is maintained and includes a set of indices and associated macro virus definition data files. One or more of the macro virus definition data files are referenced by the associated index. Each macro virus definition data file defines macro virus attributes for known macro viruses. The sets of the indices and the macro virus definition data files are organized according to macro virus families. One or more strings stored in a suspect file are compared to the macro virus attributes defined in the one or more macro virus definition data files for each macro virus family in the macro virus definitions database. The macro virus family to which the suspect file belongs is determined from the indices for each of the macro virus definition data files at least partially containing the suspect file.

Growing community of inventors

Aylesbury, United Kingdom

Viatcheslav Peternev