Patent ID: 9686304
Date: 2017-06-20
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented method for healing infected document files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: receiving an electronic message directed to a target recipient, the electronic message including a document file formatted in a portable document format, the document file further comprising a cross-reference table; in response to receiving the electronic message, discovering, by a security program in an initial pass that traverses the document file, that the document file is infected with potentially malicious content by: healing, by the security program, the infected separate object by removing both the JAVASCRIPT key and a value associated with the JAVASCRIPT key; reconstructing the document file, by the security program in a subsequent pass that traverses the document file after the initial pass, by reuniting the healed separate object with a remainder of the separate objects in a newly generated document file in a manner that preserves readability of the document file as a document; and providing access to the readable reconstructed document file at a client computing system of the target recipient.