US 8,302,193 B1Granted

Methods and systems for scanning files for malware

AssigneeSymantec Corporation

InventorsPatrick Gardner, Mark Kennedy, Everett Lai, Haik Mesropian

Life of this patent

Estimating the term…

Loading patent…

Abstract

A computer-implemented method includes identifying a file and calculating a first identifier for the file. The method may also include identifying a first malware identifier that is associated with a first malware program. The method may further include comparing the first file identifier with the first malware identifier to determine whether the file comprises the first malware program. The method may include saving the first file identifier in a manner that allows the first file identifier to be retrieved for comparison with a second malware identifier. The second malware identifier may be associated with a second malware program. Various other methods and systems are also disclosed herein.

Claims19

Dependent claims

A computer-implemented method for scanning files for malware, at least a portion of the method being performed by a computing device comprising at least one processor, the computer-implemented method comprising:

performing a first scan of the computing device, the first scan comprising:
identifying a set of files to be scanned for malware;
for each file in the set of files:
calculating a first file identifier that represents a first portion of the file;
saving the first file identifier in a manner that allows the first file identifier to be retrieved for use in a second scan of the computing device;
identifying a first malware identifier, the first malware identifier being associated with a first malware program;
comparing the first file identifier with the first malware identifier;
when a result of comparing the first file identifier with the first malware identifier suggests that the file comprises the first malware program, calculating a second file identifier that represents a second portion of the file, saving the second file identifier in a manner that allows the second file identifier to be retrieved for use in the second scan, and comparing the second file identifier with the first malware identifier to make a more definitive determination of whether the file comprises the first malware program, wherein the first and second file identifiers are calculated from different, non-overlapping portions of the file;
when a result of comparing the first file identifier with the first malware identifier indicates that the file does not comprise the first malware program, making a determination that the file does not comprise the first malware program instead of calculating the second file identifier.

6 more elements

performing a first scan of the computing device, the first scan comprising:
identifying a set of files to be scanned for malware;
determining that a first file identifier for a file in the set of files has not been saved to a file identifier table;
in response to the determination that the first file identifier for the file has not been saved:
calculating the first file identifier that represents a first portion of the file;
saving the first file identifier in the file identifier table that includes a plurality of file identifiers for files to be scanned;
identifying a first malware definition, the first malware definition being associated with a first malware program;
comparing the first malware definition with each file identifier in the file identifier table, wherein comparing the first malware definition with each file identifier in the file identifier table comprises scanning all open files on the computing device;
when a result of comparing a selected file identifier from the file identifier table with the first malware definition suggests that the a file associated with the selected file identifier comprises the first malware program, calculating an additional file identifier that represents a second portion of the file associated with the selected file identifier, saving the additional file identifier in the file identifier table, and comparing the additional file identifier with a first malware identifier to make a more definitive determination of whether the file associated with the selected file identifier comprises the first malware program;
when a result of comparing the selected file identifier with the first malware definition indicates that the file associated with the selected file identifier does not comprise the first malware program, making a determination that the file associated with the selected file identifier does not comprise the first malware program instead of calculating the additional file identifier.

7 more elements

Dependencies are inferred from the claim text.