Patent ID: 6021510
Filing Date: 2000-02-01
Classification: G06F

Abstract:
A computer-based method for examining a file associated with a digital computer, said file containing a plurality of file sectors, to determine whether a computer virus is present within said file, the method comprising the steps of:when the file is being examined an initial time:scanning selected file sectors of the file by an antivirus module, the selected file sectors being fewer than all of the file sectors and defining a critical fixed set of sectors; andstoring into a first storage area the number of each file sector that is scanned and a hash value of each sector that is scanned; andwhen the file is being examined a subsequent time:computing a hash value only for each file sector in the critical fixed set of sectors;comparing each computed hash value with the hash value stored within said first storage area for the corresponding sector; andrescanning the file by the antivirus module when any computed hash value fails to match a corresponding stored hash value for any sector in the a critical fixed set of sectors.