Method for diagnosing a data-processing installation infected with computer viruses.

p0001The invention relates to a method for diagnosing an infected computer viruses data processing system according to the features of the preamble of claim 1.

p0002Computer viruses have the ability to infect initially sterile programs, ie change in terms of quality and quantity so that the function and possibly the length of the affected program with those of the original sterile program no longer match. A virus program can occur both as an isolated program as well as in the form of already infected users program. In both cases, it has the ability to create a copy of itself and inject it into another program, which then in turn again occur as a virus and can infect other programs with the result that computer viruses can ultimately spread "snowballed".

p0003Given the damage that can cause an infected program, the timely recognition and detection of such a program is of considerable importance. In practice, these encounters but considerable difficulties because a program, especially as a comprehensive program that is should not be regarded at first glance whether it is infected or not. Comparative tests using a sterile copy of the same program on the basis of a purely visual examination would be possible in principle, but divorced from practical considerations made. The use of the data processing system for program check is ultimately not considered because machine not with absolute certainty can be determined whether a program really does what it should, except that is much less noticeable if a program does something that it does not want.

p0004Incidentally, have such routines, if they could be successfully implemented, only makes sense if they could be repeated. Virus programs can in fact be subject to a special nature, the so-called "trigger" function. The smuggled virus keeps silent then for a predetermined period and is effective only by the so-called trigger, for example, by a program incorporated in the time specified, or by special flags. So if you want to be safe from any "time bombs", the data processing system must be continuously studied in Hinblilck on possibly smuggled and emerging viruses.

p0005The present invention is based on the object to find a method by which a simple and repeatable any review of a data processing system with respect to any existing computer viruses is feasible.

p0006The solution of this object, according to the invention by the characterizing features of claim 1. An advantageous development of the invention is described in claim. 2

p0007The inventive method has the advantage that only a comparison of two codes is required instead of a very complex program comparison. Prerequisite for the functioning of the inventive method is an unequivocally sterile copy of the program, that is, the program must be made on a data processing system, from which it can be assumed with certainty that she was not infected at the time of program preparation. The guarantee that a sterile comparison "Normal" is present, can be added with the easiest one written by the subject himself program in which the subject can be sure that no virus has been planted. The virus found due to a difference between the two codes can then optionally be isolated and studied. From the nature and the virus found action methods may eventually be developed for the disinfection of the plant.

p0008In the following the invention is explained in detail with reference to the drawing. show case<ul><li>1 is a block diagram of an arrangement for generation of a test program,</li><li>2 is a block diagram of an arrangement for carrying out a test run.</li></ul>

p0009The starting point for the novel process is an absolutely virus-free program P, whose particularity is that it contains an algorithm f. According to Figure 1 of this algorithm is generated for the time to from the P program a program authentication code PAC now using, which is saved together with the P program in a storage medium M.

p0010This, test program formed from the virus-free program P and the program authentication code PAC will be introduced according to Figure 2 at later time points t1, t2 ... tn as so-called bait program in which to be examined data processing system, in order to determine whether these data processing system still sterile or is already infested by so-called computer viruses. This, for example, through a present in the data processing system timer T triggered test runs now from so that from the stored test program, ie f is another program authentication code PAC produced 'with the included P program algorithm. Both of these newly formed program authentication code PAC 'and the stored program authentication code PAC a comparator COMP are finally supplied, which generates an error signal in inequality of signals.