Patent ID: 7478431

Claim:
A computer-implemented method for detecting the presence of viral infections in target files located within a computer, said method comprising the steps of: computing a target section corresponding to an invariant section of a target file of the target files, wherein the invariant section comprises a section of the target file that has been identified as unchanged by viral infections of the target file and to repairs thereof; scanning the target file with an antivirus scanner; declaring the target file to be a tracked file when the target section matches an invariant section in a database generated from uninfected versions of the target files; for each tracked file, identifying a variant section that is likely to be varied by a viral infection; comparing the variant section in the tracked file with the same variant section in the uninfected version of the tracked file in the database; and declaring a suspicion that a virus is present in the tracked file when the two variant sections do not match.