Methods for detecting executable code which has been altered

A method for disabling executable code which has been modified without authorization having executable instructions, comprising the steps of:

• identifying an executable code having an unaltered size;
• calculating an initial score associated with the executable code when the executable code is initially or shortly thereafter loaded into an operating system;
• calculating a plurality of subsequent scores on the executable code;
• exclusively comparing each of the subsequent scores to the initial score and to no other scores;
• concluding the executable code has been modified if any of the subsequent scores vary from the initial score, the concluding further including determining whether the variance corresponds to a valid condition of a vendor;
• and
• disabling the executable code if the variance does not correspond to the valid condition.

A method of authenticating executable code resident in a memory having executable instructions, comprising the steps of:

• identifying an executable code having an unaltered format;
• acquiring a score associated with an executable code which was established when the executable code was first loaded into a memory of an operating system;
• one of randomly, periodically and substantially each time the executable code is launched for use after the executable code is said first loaded, receiving subsequent scores on the executable code while the executable code is in the memory;
• exclusively comparing the subsequent scores to the score;
• if the subsequent scores do not vary from the score, executing the executable code in the unaltered format;
• if any of the subsequent scores vary from the initial score, determining whether the variance corresponds to a valid condition;
• and
• if the variance does not correspond to the valid condition, indicating the executable code has an altered format.

A system for validating executable code, comprising:

• an executable code having an unaltered size;
• a scoring set of executable instructions operable to receive and record a score associated with the executable code when the code is initially loaded into a computer readable medium;
• a comparing set of executable instructions in an operating system of a computing device operable to receive subsequent scores associated with the code and to exclusively compare each of the subsequent scores to the score and to no other score, provided that if any of the subsequent scores varies from the score the comparing set of executable instructions are operable to determine whether the variance corresponds to a valid condition of a vendor of the computer readable medium;
• and
• an executable code having an altered size if the score and the subsequent scores do not equal.