06357008 is referenced by 329 patents and cites 1 patents.

A method for detecting computer viruses comprising three phases: a decryption phase, an exploration phase, and an evaluation phase. A purpose of the decryption phase is to emulate a sufficient number of instructions to allow an encrypted virus to decrypt its viral body. A purpose of the exploration phase is to emulate at least once all sections of code within a region deemed likely to contain any virus present in the target program. A purpose of the evaluation phase is to analyze any suspicious behavior observed during the decryption and exploration phases to determine whether the target appears to be infected.

Title
Dynamic heuristic method for detecting computer viruses using decryption exploration and evaluation phases
Application Number
8/935577
Publication Number
6357008 (B1)
Application Date
September 23, 1997
Publication Date
March 12, 2002
Inventor
Carey S Nachenberg
Northridge
CA, US
Agent
Fenwick & West
US
Assignee
Symantec Corporation
CA, US
IPC
H04L 9/00
View Original Source