Patent ID: 7367056
Filing Date: 2008-04-29
Classification: G06F,H04L

Abstract:
1. A computer-implemented method for detecting a primary malicious code infection in a test file that is at risk of having also been infected by a secondary malicious code infection, the method comprising the steps of: selecting a section of a computer file that corresponds to the test file, wherein the selected section is invariant to the secondary malicious code infection and to repair thereof; using the selected section to generate a template corresponding to each of a set of primary malicious code infections, the template to be used to test for the presence of the primary malicious code infection; identifying a target section within the test file corresponding to the selected section; comparing the target section with each of the generated templates; and when the target section matches a generated template corresponding to a primary malicious code infection, declaring the presence of the primary malicious code infection in the test file.