Appeal No. 2002-2176 Page 2
Application No. 08/948,931
MS-DOSŪ operating system, for example, requests by an application program to read a
diskette are serviced by a Basic Input/Output System ("BIOS").1 (Id. at 7.) To hide its
presence, a stealth virus may install itself in the BIOS' Master Boot Record ("MBR")2
and modify attempts to read the MBR. The virus may also create a copy or "facade" of
the original, uninfected MBR. (Id. at 4.) Attempts to check the integrity of the MBR via
checksums or data values, explain the appellant, are then intercepted by the virus and
performed on the copy instead of the infected MBR. The virus thus evades detection.
(Id. at 4-5.)
In contrast, the appellants' invention uses an alternate BIOS to detect and
remove viruses. Unlike the standard BIOS, they assert, the alternate BIOS is trusted
because it has been "kept inaccessible to viruses." (Id. at 8.) Viruses can be detected,
the appellants add, by noting any difference between results obtained using the
standard, possibly infected BIOS and the uninfected, alternate BIOS. (Id. at 7.) The
invention also relocates facades to their proper location. (Id. at 8.)
1The BIOS enables a programmer to operate a disk drive without acquiring an
exhaustive knowledge of the specific brand of drive hardware being used. The BIOS is
typically stored in a read-only memory chip. (Spec. at 2-3.)
2The MBR contains a disk boot program that will load operating system code and
eventually pass control to a command interpreter or other user interface. (Spec. at 3.)
Page: Previous 1 2 3 4 5 6 7 8 9 10 Next
Last modified: November 3, 2007