US5951698A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System, apparatus and method for the detection and removal of viruses in macros
Assignee: Trend Micro Inc
•
Filing: 1996-10-02
•
Granted: 1999-09-14
•
Expires: 2016-10-02
Abstract
Abstract The detection and removal of viruses from macros is disclosed. A macro virus detection module includes a macro locating and decoding module, a macro virus scanning module, a macro treating module, a file treating module, and a virus information module. The macro locating and decoding module determines whether a targeted file includes a macro, and, where a macro is found, locates and decodes it to produce a decoded macro. The macro virus scanning module accesses the decoded macro and scans it to determine whether it includes any viruses. Unknown macro viruses are detected by the macro virus scanning module by obtaining comparison data that includes sets of instruction identifiers from the virus information module and determining whether the decoded macro includes a combination of suspect instructions which correspond to instruction identifiers. The macro treating module locates suspect instructions in the decoded macro using the comparison data and removes the suspect instructions to produce a treated macro. The file correcting module accesses a targeted file with an infected macro and replaces the infected macro with the treated macro produced by the macro treating module.
Inventors
- 👤 Eva Y. Chen
- 👤 Jonny T. Ro
- 👤 Ming M. Deng
- 👤 Leta M. Chi
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-04 18:00
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/563
Claims Analysis
Total Claims: 35
Claim 1
Independent Claim
145 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: obtaining comparison data including information for detecting a virus; retrieving a macro; decoding the macro to produce a decoded macro; and scanning the decoded macro for a virus by comparing the decoded macro to the comparison data; wherein the comparison data includes a first suspect instruction identifier and a second suspect instruction identifier; wherein the scanning the decoded macro comprises: determining whether the decoded macro includes a first portion which corresponds to the first suspect instruction identifier; determining whether the decoded macro includes a second portion which corresponds to the second suspect instruction identifier; determining that the decoded macro includes the virus if the decoded macro includes the first and second portions; and wherein the first suspect instruction identifier identifies a macro virus enablement instruction.
Claim 2
Dependent Claim
145 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: obtaining comparison data including information for detecting a virus; retrieving a macro; decoding the macro to produce a decoded macro; and scanning the decoded macro for a virus by comparing the decoded macro to the comparison data; wherein the comparison data includes a first suspect instruction identifier and a second suspect instruction identifier; wherein the scanning the decoded macro comprises: determining whether the decoded macro includes a first portion which corresponds to the first suspect instruction identifier; determining whether the decoded macro includes a second portion which corresponds to the second suspect instruction identifier; determining that the decoded macro includes the virus if the decoded macro includes the first and second portions; and wherein the first suspect instruction identifier identifies a macro virus enablement instruction.
Claim 3
Dependent Claim
33 words
The method of claim 1, further comprising: removing the virus from the macro to produce a treated macro if the scanning the decoded macro indicates that the macro is infected with the virus.
Claim 4
Dependent Claim
55 words
The method of claim 1, wherein the retrieving a macro comprises: accessing a targeted file; determining whether the targeted file is a template file; if the targeted file is not a template file, determining whether the targeted file includes an embedded macro; and if the targeted file includes an embedded macro, locating the embedded macro.
Claim 5
Dependent Claim
17 words
The method of claim 1, wherein the second suspect instruction identifier detects a macro virus reproduction instruction.
Claim 6
Dependent Claim
36 words
The method of claim 1, wherein the removing the virus comprises: locating a first suspect macro instruction in the decoded macro which corresponds to the first suspect instruction identifier; and removing the first suspect macro instruction.
Claim 7
Dependent Claim
23 words
The method of claim 5, wherein the removing the first suspect macro instruction includes replacing the first suspect instruction with a benign instruction.
Claim 8
Dependent Claim
45 words
The method of claim 5, wherein the removing the virus comprises: locating a second suspect macro instruction in the decoded macro which corresponds to the second suspect instruction identifier; and removing the second suspect macro instruction from the decoded macro to produce a treated macro.
Claim 9
Dependent Claim
18 words
The method of claim 1, wherein the comparison data includes a plurality of sets of suspect instruction identifiers.
Claim 10
Dependent Claim
114 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: obtaining comparison data including information for detecting a virus; retrieving a macro; decoding the macro to produce a decoded macro; scanning the decoded macro for a virus by comparing the decoded macro to the comparison data; and removing the virus from the macro to produce a treated macro if the step of scanning the decoded macro indicates that the macro is infected with the virus; verifying the integrity of the treated macro; and replacing the infected macro in a targeted file with the treated macro dependent upon the integrity verification of the treated macro.
Claim 11
Dependent Claim
114 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: obtaining comparison data including information for detecting a virus; retrieving a macro; decoding the macro to produce a decoded macro; scanning the decoded macro for a virus by comparing the decoded macro to the comparison data; and removing the virus from the macro to produce a treated macro if the step of scanning the decoded macro indicates that the macro is infected with the virus; verifying the integrity of the treated macro; and replacing the infected macro in a targeted file with the treated macro dependent upon the integrity verification of the treated macro.
Claim 12
Dependent Claim
99 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: obtaining comparison data including information for detecting a virus; retrieving a macro; decoding the macro to produce a decoded macro; scanning the decoded macro for a virus by comparing the decoded macro to the comparison data; wherein the comparison data includes a first suspect instruction identifier and a second suspect instruction identifiers; and wherein a first set of respective first and second suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 67 C2 80.
Claim 13
Dependent Claim
99 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: obtaining comparison data including information for detecting a virus; retrieving a macro; decoding the macro to produce a decoded macro; scanning the decoded macro for a virus by comparing the decoded macro to the comparison data; wherein the comparison data includes a first suspect instruction identifier and a second suspect instruction identifiers; and wherein a first set of respective first and second suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 67 C2 80.
Claim 14
Dependent Claim
130 words
The method of claim 10, wherein a second set of respective first and second suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 64 6F 02 67 DE 00 73 87 01 12 73 7F, a third set of respective first and second suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 6D 61 63 72 6F 73 76 08, a fourth set of respective first and second suspect instruction identifiers comprises the strings 12 6C 01 00 and 64 67 C2 80 6A 0F 47, and a fifth set of respective first and second suspect instruction identifiers comprises the strings 79 7C 66 6F 72 6D 61 74 20 63 6A and 80 05 6A 07 43 4F 4D.
Claim 15
Dependent Claim
132 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: retrieving a macro; obtaining comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; scanning the macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier; scanning the macro to determine whether the macro includes a second portion which corresponds to the second suspect instruction identifier; and determining that the macro is infected with the virus if the macro includes the first and second portions; wherein the first suspect instruction identifier includes the string 73 CB 00 0C 6C 01 00 and the second suspect instruction identifier includes the string 67 C2 80.
Claim 16
Dependent Claim
132 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: retrieving a macro; obtaining comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; scanning the macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier; scanning the macro to determine whether the macro includes a second portion which corresponds to the second suspect instruction identifier; and determining that the macro is infected with the virus if the macro includes the first and second portions; wherein the first suspect instruction identifier includes the string 73 CB 00 0C 6C 01 00 and the second suspect instruction identifier includes the string 67 C2 80.
Claim 17
Dependent Claim
28 words
The method of claim 12, further comprising: treating the macro to produce a treated macro if it is determined that the macro includes the first and second portions.
Claim 18
Dependent Claim
43 words
The method of claim 13, wherein the treating the macro comprises: locating a first macro instruction in the infected macro which corresponds to the first suspect instruction identifier; and removing the first macro instruction from the infected macro to repair the infected macro.
Claim 19
Dependent Claim
43 words
The method of claim 14, wherein the treating the macro comprises: locating a second macro instruction in the infected macro which corresponds to the second suspect instruction identifier; and removing the second macro instruction from the infected macro to repair the infected macro.
Claim 20
Dependent Claim
54 words
The method of claim 12, wherein the retrieving a macro comprises: accessing a targeted file; and determining whether the targeted file is a template file; if the file is not a template file, determining whether the targeted file includes an embedded macro; and if the file includes an embedded macro, locating the embedded macro.
Claim 21
Dependent Claim
18 words
The method of claim 12, wherein the comparison data includes a plurality of sets of suspect instruction identifiers.
Claim 22
Dependent Claim
250 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: retrieving a macro; obtaining comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; scanning the macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier; scanning the macro to determine whether the macro includes a second portion which corresponds to the second suspect instruction identifier; determining that the macro is infected with the virus if the macro includes the first and second portions, wherein the comparison data includes a plurality of sets of respective first and second suspect instruction identifiers; and wherein a first set of suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 67 C2 80, a second set of suspect instruction comprises the strings 73 CB 00 0C 6C 01 00 and 64 6F 02 67 DE 00 73 87 01 12 73 7F, a third set of suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 6D 61 63 72 6F 73 76 08, a fourth set of suspect instruction identifiers comprises the strings 12 6C 01 00 and 64 67 C2 80 6A 0F 47, and a fifth set of suspect instruction identifiers comprises the strings 79 7C 66 6F 72 6D 61 74 20 63 6A and 80 05 6A 07 43 4F 4D.
Claim 23
Dependent Claim
250 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: retrieving a macro; obtaining comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; scanning the macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier; scanning the macro to determine whether the macro includes a second portion which corresponds to the second suspect instruction identifier; determining that the macro is infected with the virus if the macro includes the first and second portions, wherein the comparison data includes a plurality of sets of respective first and second suspect instruction identifiers; and wherein a first set of suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 67 C2 80, a second set of suspect instruction comprises the strings 73 CB 00 0C 6C 01 00 and 64 6F 02 67 DE 00 73 87 01 12 73 7F, a third set of suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 6D 61 63 72 6F 73 76 08, a fourth set of suspect instruction identifiers comprises the strings 12 6C 01 00 and 64 67 C2 80 6A 0F 47, and a fifth set of suspect instruction identifiers comprises the strings 79 7C 66 6F 72 6D 61 74 20 63 6A and 80 05 6A 07 43 4F 4D.
Claim 24
Dependent Claim
159 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: retrieving a macro; obtaining comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; scanning the macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier; scanning the macro to determine whether the macro includes a second portion which corresponds to the second suspect instruction identifier; determining that the macro is infected with the virus if the macro includes the first and second portions; and treating the macro to produce a treated macro if it is determined that the macro includes the firs and second portions, further comprising: accessing a targeted file; locating a macro within the targeted file; removing the macro from the targeted file; and adding the treated macro to the targeted file to produce a corrected file.
Claim 25
Dependent Claim
159 words
In a computer system comprising a processor and a memory, a method for detecting viruses in macros, the method comprising: retrieving a macro; obtaining comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; scanning the macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier; scanning the macro to determine whether the macro includes a second portion which corresponds to the second suspect instruction identifier; determining that the macro is infected with the virus if the macro includes the first and second portions; and treating the macro to produce a treated macro if it is determined that the macro includes the firs and second portions, further comprising: accessing a targeted file; locating a macro within the targeted file; removing the macro from the targeted file; and adding the treated macro to the targeted file to produce a corrected file.
Claim 26
Independent Claim
226 words
An apparatus for detecting viruses in macros, the apparatus comprising: a virus information module, for storing comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; a macro virus scanning module, in communication with the virus information module, for receiving the comparison data and scanning a macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier and a second portion which corresponds to the second suspect instruction identifier; a macro locating and decoding module, in communication with the macro virus scanning module, for accessing a targeted file, determining whether the targeted file is a template file, determining whether the targeted file includes an embedded macro, and decoding the macro to produce a decoded macro; a macro treating module, in communication with the virus information module, for accessing the decoded macro and removing a first macro instruction which corresponds to the first suspect instruction identifier and a second macro instruction which corresponds to the second suspect instruction identifier to produce a treated macro; and a file correcting module, in communication with the macro treating module, for accessing the targeted file, locating the macro within the targeted file, removing the macro from the targeted file and adding the treated macro to the targeted file to produce a corrected file.
Claim 27
Independent Claim
226 words
An apparatus for detecting viruses in macros, the apparatus comprising: a virus information module, for storing comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; a macro virus scanning module, in communication with the virus information module, for receiving the comparison data and scanning a macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier and a second portion which corresponds to the second suspect instruction identifier; a macro locating and decoding module, in communication with the macro virus scanning module, for accessing a targeted file, determining whether the targeted file is a template file, determining whether the targeted file includes an embedded macro, and decoding the macro to produce a decoded macro; a macro treating module, in communication with the virus information module, for accessing the decoded macro and removing a first macro instruction which corresponds to the first suspect instruction identifier and a second macro instruction which corresponds to the second suspect instruction identifier to produce a treated macro; and a file correcting module, in communication with the macro treating module, for accessing the targeted file, locating the macro within the targeted file, removing the macro from the targeted file and adding the treated macro to the targeted file to produce a corrected file.
Claim 28
Dependent Claim
18 words
The apparatus of claim 20, wherein the comparison data includes a plurality of sets of suspect instruction identifiers.
Claim 29
Independent Claim
115 words
An apparatus for detecting viruses in macros, the apparatus comprising: a virus information module, for storing comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; and a macro virus scanning module, in communication with the virus information module, for receiving the comparison data and scanning a macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier and a second portion which corresponds to the second suspect instruction identifier, wherein the first instruction identifier includes the string 73 CB 00 0C 6C 01 00 and the second suspect instruction identifier includes the string 67 C2 80.
Claim 30
Independent Claim
115 words
An apparatus for detecting viruses in macros, the apparatus comprising: a virus information module, for storing comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; and a macro virus scanning module, in communication with the virus information module, for receiving the comparison data and scanning a macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier and a second portion which corresponds to the second suspect instruction identifier, wherein the first instruction identifier includes the string 73 CB 00 0C 6C 01 00 and the second suspect instruction identifier includes the string 67 C2 80.
Claim 31
Independent Claim
235 words
An apparatus for detecting viruses in macros, the apparatus comprising: a virus information module, for storing comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; and a macro virus scanning module, in communication with the virus information module, for receiving the comparison data and scanning a macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier and a second portion which corresponds to the second suspect instruction identifier; wherein the comparison data includes a plurality of sets of respective first and second suspect instruction identifiers; and wherein a first set of suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 67 C2 80, a second set of suspect instruction comprises the strings 73 CB 00 0C 6C 01 00 and 64 6F 02 67 DE 00 73 87 01 12 73 7F, a third set of suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 6D 61 63 72 6F 73 76 08, a fourth set of suspect instruction identifiers comprises the strings 12 6C 01 00 and 64 67 C2 80 6A 0F 47, and a fifth set of suspect instruction identifiers comprises the strings 79 7C 66 6F 72 6D 61 74 20 63 6A and 80 05 6A 07 43 4F 4D.
Claim 32
Independent Claim
235 words
An apparatus for detecting viruses in macros, the apparatus comprising: a virus information module, for storing comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; and a macro virus scanning module, in communication with the virus information module, for receiving the comparison data and scanning a macro to determine whether the macro includes a first portion which corresponds to the first suspect instruction identifier and a second portion which corresponds to the second suspect instruction identifier; wherein the comparison data includes a plurality of sets of respective first and second suspect instruction identifiers; and wherein a first set of suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 67 C2 80, a second set of suspect instruction comprises the strings 73 CB 00 0C 6C 01 00 and 64 6F 02 67 DE 00 73 87 01 12 73 7F, a third set of suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 6D 61 63 72 6F 73 76 08, a fourth set of suspect instruction identifiers comprises the strings 12 6C 01 00 and 64 67 C2 80 6A 0F 47, and a fifth set of suspect instruction identifiers comprises the strings 79 7C 66 6F 72 6D 61 74 20 63 6A and 80 05 6A 07 43 4F 4D.
Claim 33
Independent Claim
157 words
An apparatus for detecting viruses in macros, the apparatus comprising: means for obtaining comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; means for scanning the macro to determine whether a macro includes a first portion which corresponds to the first suspect instruction identifier; means for scanning the macro to determine whether the macro includes a second portion which corresponds to the second suspect instruction identifier; means for determining that the macro is infected with the virus if the macro includes the first and second portions; means for accessing a targeted file and determining whether the targeted file includes a macro; and means for correcting a file, the means for correcting a file including means for accessing the targeted file, means for removing the macro from the targeted file and means for adding the treated macro to the targeted file to produce a corrected file.
Claim 34
Independent Claim
157 words
An apparatus for detecting viruses in macros, the apparatus comprising: means for obtaining comparison data for detecting a virus, the comparison data including a first suspect instruction identifier and a second suspect instruction identifier; means for scanning the macro to determine whether a macro includes a first portion which corresponds to the first suspect instruction identifier; means for scanning the macro to determine whether the macro includes a second portion which corresponds to the second suspect instruction identifier; means for determining that the macro is infected with the virus if the macro includes the first and second portions; means for accessing a targeted file and determining whether the targeted file includes a macro; and means for correcting a file, the means for correcting a file including means for accessing the targeted file, means for removing the macro from the targeted file and means for adding the treated macro to the targeted file to produce a corrected file.
Claim 35
Dependent Claim
58 words
The apparatus of claim 24, further comprising: means for locating a first macro instruction and a second macro instruction within the macro which respectively correspond to the first suspect instruction identifier and the second suspect instruction identifier; and means for removing the first macro instruction and the second macro instruction from the macro to produce a treated macro.
References Cited (Backward Citations)
US5321840A
Cited
US4975950A
Cited
US5319776A
Cited
US5408642A
Cited
US5511163A
Cited
US5649095A
Cited
WO1993022723A1
Cited
US5278901A
Cited
US5550976A
Cited
US5452442A
Cited
US5440723A
Cited
JPH06350784A
Cited
US5448668A
Cited
US5444850A
Cited
US5414833A
Cited
EP0666671A1
Cited
US5530757A
Cited
US5485575A
Cited
US5550984A
Cited
US5491791A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-09-13 | 2003-03-15 | 2003-09-14 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-09-13 | 2007-03-15 | 2007-09-14 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-09-13 | 2011-03-15 | 2011-09-14 | $7700.00 | Window Closed / Lapsed |