Patent ID: 8256000

Claim:
A computing system implemented process for identifying Icons comprising: providing a known/clean file Icon database, the known/clean file Icon database including Icon image data associated with one or more Icons associated with one or more applications; using one or more processors associated with one or more computing systems to monitor a given user computing system to detect and intercept all PE files being directed to the given user computing system; using one or more processors associated with one or more computing systems to scan the resource section of all PE files being directed to the given user computing system to detect .ico files; detecting a given .ico file in the resource section of a given PE file; extracting the given .ico file from the resource section of a given PE file using one or more processors associated with one or more computing systems; extracting relevant image data from the given .ico file; obtaining known/clean Icon image data from the known/clean file Icon database; defining a threshold matching level such that if the extracted relevant image data from the given .ico file matches with known/clean Icon image data obtained from the known/clean file Icon database to at least the defined threshold match level, data indicating a status of the extracted .ico file and the given file, is transformed to data indicating a status of Icon match; comparing the relevant image data from the given .ico file and clean/known Icon image data from the known/clean file Icon database; and if the extracted relevant image data from the given .ico file matches with known/clean Icon image data obtained from the known/clean file Icon database to at least the defined threshold match level, transforming data indicating a status of the extracted .ico file and the given PE file, to data indicating a status of Icon match.