Software virus detection methods, apparatus and articles of manufacture
Methods, apparatus and articles of manufacture for identifying, authenticating and securing code through proscribed code detection and deletion are shown. The preferred embodiments provide for scanning code to determine the presence of proscribed code and then transmitting the code to a file reconstructor upon the detection of proscribed code. At the file reconstructor, templates of the specific document type are used to provide the document file structure, and so delete with precision the proscribed code from the original code.
1. A proscribed code detection method that utilizes a stored code template to reconstruct a file according to the file's data structure identification to facilitate restoration of document structure and/or properties, comprising: examining a file to determine whether proscribed code is contained within the file by scanning said file with a proscribed code scanner, and where proscribed code is not present in the examined file permitting the file to continue its intended path of travel, and where proscribed code is present in the examined file, sending said file to a reconstructor, and locating proscribed code within a file sent to said reconstructor; analyzing said file header information and any other information contained in the body of said file which is needed in conjunction with said file header information to determine whether there is correspondence with a stored code template; and where there is correspondence between a stored code template:
selecting a said corresponding stored code template for said file which is specific for said file based on said file type;
applying said stored code template to said file;
reconstructing said file by means of said stored code template; and,
modifying at least part of said file containing said proscribed code, wherein said stored code template corresponds with said file's data structure identification to facilitate differentiation of said file's structure;
and where there is no correspondence with a stored code template, holding said file in a buffer for further processing.
2. A method as in claim 1 further comprising the step of intercepting said file as it is transmitted through a communication channel.
3. A method as in claim 1 wherein selecting a template for said file further comprises the step of selecting a template from a predefined group of templates.
4. A method as in claim 1 wherein the step of determining the file type further comprises determining the file type from information contained within the file, including one or more document property blocks.
5. The method of claim 4 , wherein at least one document property block comprises a file header block.
6. A method as in claim 1 wherein the step of modifying at least part of said file containing said proscribed code further comprises deleting said at least part of said file containing said proscribed code.
7. A method as in claim 4 wherein deleting said at least part of said file containing said proscribed code further comprises deleting at least some of the macro part of said file.
8. A method as in claim 1 further comprising implementing said method on a first platform, for scanning said code that is generated by a second platform.
9. The proscribed code detection method of claim 1 , wherein the step of modifying at least part of said file containing said proscribed code comprises removing the code in said file that corresponds with the code of a stored code template and replacing that code with the code of said stored code template.