Abstract: A method of screening a software file for viral infection comprising defining a first database of known macro virus signatures, a second database of known and certified commercial macro signatures, and a third database of known and certified local macro signatures. The file is scanned to determine whether or not the file contains a macro. If the file contains a macro, a signature for the macro is determined and screened against the signatures contained in said databases. A user is alerted in the event that the macro has a signature corresponding to a signature contained in said first database and/or in the event that the macro has a signature which does not correspond to a signature contained in either of the second and third databases.
Type:
Grant
Filed:
October 2, 1998
Date of Patent:
June 10, 2003
Assignee:
Data Fellows Oyj
Inventors:
Mikko Hyppönen, Ari Hyppönen, Mikko Kuisha, Urmas Rahu, Risto Siilasmaa