| 摘要 |
System and method for examining a file (1) associated with an originating computer (2) to determine whether a computer virus is present within the fil e (1). The file (1) contains at least one sector. The file (1) is scanned by a n antivirus module (3) associated with the originating computer (2). At that time, an identification of each scanned sector, a hash value for each scanne d sector, a date of a most recent update to the antivirus module (3), and a version number of the antivirus module (3) are stored into a critical sector s file (4). The hash values can be calculated by an antivirus accelerator modu le (5). An authentication module (12) affixes a digital signature to the critic al sectors file (4). The file (1), the critical sectors file (4), and the digit al signature (15) are then transmitted over a computer network (14) to a recipient computer (11). An antivirus module (3'), an accelerator module (5' ), and an authentication module (12'), respectively identical to corresponding modules (3, 5, 12) of the originating computer (2), are associated with the recipient computer (11). All of the file (1) sectors that were scanned by th e originating computer (2) are examined by said second antivirus module (3'). Each of these sectors again has its hash value calculated and compared with the hash value of the corresponding sector as stored within the critical sectors file (4). When any calculated hash value fails to match a corresponding stored hash value for any sector, the second antivirus module (3') is commanded to rescan the entire file (1). Additionally, the recipient computer (11) decrypts the digital signature (15) produced by the originatin g computer (2) to verify the authenticity of the contents of the critical sectors file (4). |
