The U.S. patent office has approved an application from Kaspersky Labs today for a hardware based antivirus solution. The announcement emphasizes that the hardware operates below the level of rootkits and therefore can't be bypassed by them. It seems this device is an actual separate computer running an embedded AV application. While the press release and abstract emphasize that the AV functionality doesn't strictly need a software counterpart running in the host system, it does need host software in order to update itself, because the AV hardware won't have network access. This update application will need to be trusted and hardened against attack.

An anti-virus (AV) system based on a hardware-implemented AV module for curing infected computer systems and a method for updating AV databases for effective curing of the computer system. The hardware-based AV system is located between a PC and a disk device. The hardware-based AV system can be implemented as a separate device or it can be integrated into a disk controller. An update method of the AV databases uses a two-phase approach. First, the updates are transferred to from a trusted utility to an update sector of the AV system. Then, the updates are verified within the AV system and the AV databases are updated. The AV system has its own CPU and memory and can be used in combination with AV application.