Abstract: A computer-implemented method, apparatus, and computer readable medium for detecting publicly identified and publicly unidentified macro viruses within code (15) adapted for use on a digital computer (1). A detection module (17) analyzes the code (15) to determine whether the code (15) contains instructions causing a macro (8) to be moved to a global environment (13), and whether said code (15) also contains instructions causing the same macro (8) to be copied to a local document (11). When these two conditions are satisfied, detection module (17) declares that a macro virus is present within the code (8). A repair module (19) can be coupled to the detection module (17) and to the code (15) for deleting the code (15) when the detection module (17) declares that the code (15) contains a macro virus.

Abstract: A computer system (100) and method detect computer viruses spanning multiple data streams. A virus signature is written in the form of a Boolean expression, where the operands of the Boolean expression are signatures of components of the virus. A processor (110) identifies data streams to be scanned and scans the identified data streams for components of viruses. Using the scan results, the processor (110) then evaluates the virus signatures, and, for any Boolean expression satisfied, the processor (110) determines that the virus corresponding to the expression exists in the scanned data streams.

Abstract: Apparatus and method for detecting the presence of macro viruses within a digital computer (1). An application program (5) is associated with the digital computer (1). A global environment (13) is associated with the application program (5). The application program (5) generates at least one local document (11). Macros contained within the global environment (13) and the local document(s) (11) are executed in a simulated manner by an emulator (15). At least one preselected decision criterion is used by a detection module (17) to declare when a macro virus is deemed to be present. Such a criterion is typically the presence of a bidirectional macro, i.e., a macro that copies from a local document (11) to the global environment (13) and vice-versa. Macros deemed to be viruses are preferably deleted by a repair module (19). Additional deletion criteria may include the presence of macros that have the same source name or the same destination name as a bidirectional macro.

Abstract: A system and method accelerate access time to multiplexed data streams. Data streams are stored in a storage medium (120), and a link allocation table (LAT) (160), which is stored in the storage medium (120), maps blocks of a data stream to sectors of the storage medium (120). The LAT (160) is organized as a set of linked lists, and each data stream is associated with a different linked list in the LAT (160). Each link in a linked list includes the sector location for a different block of the data steam. Traversing the links of the linked list gives the sector location of each subsequent block of data. Each data stream is also associated with a cache memory (140). For each link of a linked list that is traversed, a cache interface (150) writes into an appropriate cache (140) the sector location information stored in the link.