Patent ID: 7043634

Claim:
A computer program product comprising a computer program operable to control a computer to detect a malicious alteration to a stored computer file, said computer program comprising: file comparing logic operable to directly compare the entire contents of said stored computer file with the entire contents of an archive copy of said computer file as stored when said stored computer file was created; and comparison response logic operable if said file comparing logic detects that the entire contents of said stored computer file and the entire contents of said archive computer file do not match to trigger further countermeasures against a potential malicious alteration; wherein a subset of file types stored by said computer are subject to comparison by said file comparing logic and to creation of an archive copy for use with said file comparing logic; wherein, upon creation of said stored computer file, said archive copy of said computer file is also created; wherein said archive copy of said computer file is created for a subset of file types stored by said computer; wherein said subset of file types includes one or more of: executable file types; and dynamic link library file types.