SYSTEM AND METHOD OF DETERMINING POTENTIALLY MALICIOUS SOFTWARE BASED ON MONITORING FILE INTEGRITY USING TIME MARKS Russian patent published in 2011 - IPC G06F11/30 G06F12/16 

FIELD: information technology.

SUBSTANCE: user application function calls are intercepted before changing the time mark of a file; the record on the number of changes to the time mark of the file made by the application is updated; the record on the number of changes to the time mark of the file made by the application is updated; if possible, the record is stored in the address space of the operating system; upon request of the control application, the record is sent to the application and then compared with information stored in the control application; finally, depending on the comparison result, the corresponding action is taken (for example, the application which modified the file is scanned for viruses) if the record does not correspond to information stored in the control application. The control application contains a data base of the number of changes to the time mark of the file in form of a counter which corresponds to each file.

EFFECT: efficient monitoring of altered files.

4 cl, 11 dwg