Patent ID: 7526516
Filing Date: 2009-04-28
Classification: G06F,Y10S

Abstract:
1. A computer implementable method of monitoring file integrity comprising computer-executable code stored on a computer-readable medium, for performing the steps of: (a) intercepting an operating system request to change a timestamp of a file by detecting an invocation of the operating system timestamp change function; (b) in an antivirus application, maintaining a counter of a number of times the timestamp change function was invoked; (c) updating the counter each time the timestamp change function is invoked to change the timestamp; (d) in the antivirus application, comparing the counter to a prior value, so as to detect a change of the timestamp using the operating system timestamp function that occurred without a file system writing to the file, where the counter changed but the timestamp of the file does not accurately reflect the change; and (e) performing additional analysis of the file by the antivirus application if the counter does not match the prior value that was maintained by the antivirus application.