Mcafee, Inc.

Networks Associates Technology, Inc.

Daniel Joseph Wolff

Lee Codel Lawson Tarbotton

Graham Arthur Makinson

Igor G Muttik

Jonathan Lewis Edwards

Joel Robert Spurlock

Paul Nicholas Gartside

Neil Andrew Cowie

Nicholas Paul Kelly

Mark David Harris

Robert Hugh Smithson

Martin James Lucas

Robert Edward Moore

Eamonn John Baulk

Michael Kenneth Glover

Timothy James Page

Edward Moore

A method for defining an area to record changes made to a computer system is provided. A safe area is defined on a primary storage device of the computer system and information is stored on the location of the safe area on a secondary storage device. Further, the computer system is booted utilizing a backup device and data is changed on the primary storage device. The changes are recorded in the safe area of the primary storage device and are accessible when the computer system is booted from the backup device.

Method and system for defining a safe storage area for use in recovering a computer system

When a user commands execution of a computer program to commence, a loader programis first started. This loader programreads an encrypted version of the computer programand decrypts it using a public key. This generates an executable version of the computer programwhich is written directly to the computer memory. When the loader programhas decrypted the whole of the computer programit starts execution of the computer programit has written into the computer memoryand terminates itself or is terminated by the computer program it started. The computer programwritten into the computer memorywill be written into its own memory space and will have its own execution thread. The encryption used may be public key/private key encryption.

Initiating execution of a computer program from an encrypted version of a computer program

A system, method and computer program product are provided for preventing writes to critical files. Initially, factors associated with a computer are identified. Then, requests to write to files on the computer are monitored. The writes to the files on the computer are conditionally prevented based on the factors to prevent virus proliferation. In use, the factors are altered based on the monitoring of the requests.

System, method and computer program product for precluding writes to critical files

A software audit system is provided in conjunction with an anti-virus system. A computer virus scan request received by the anti-virus system () is used to trigger an audit data generator () to generate audit data. The audit data generator () may also serve to ban certain computer programs from execution and monitor the concurrent usage of other computer programs.

Software audit system

An anti computer virus program uses a library of virus drivers that includes an indication of whether a particular virus can cause irreparable damage and data indicating enhanced user warnings and actions that might be associated with such viruses. If a detected computer virus is one that can cause irreparable damage, then an enhanced user warning () is issued indicating this to the user and a notification () of the possibility of such corruption is added into the repaired computer file. The notification may take the form of an electronically signed () banner message or the like.

User alerts in an anti computer virus system

An event report, such as a virus detection event, is sent from a reporting computerto a receiving computervia an internet link. The report data may take the form of a URL requesting a web pageto be provided by the receiving computer, the URL bearing an encrypted formof the report data that is used to identify the requested web page as well as pass further information to the receiving computer. Alternatively, the report data may be collated in the reporting computerand passed to the receiving computerwhen a computer virus definition data update is requested. The report data seeks to uniquely identify the event by incorporating the MAC address of the reporting computer, the date, time, computer product identifier, version identifier, update identifier and driver triggered. Additionally, a checksum derived from the infected file together with an indication of the corrective action, if any, taken by the reporting computermay be included. The report data sent to the receiving computermay be used to obtain real life information concerning the prevalence of particular viruses together with information characterising the anti-virus programs and their update status being employed by the user community.

Event reporting between a reporting computer and a receiving computer

The present invention relates to a proxy device, computer program product and method for performing malware scanning of files stored within a file storage device of a computer network. The computer network has a plurality of client devices arranged to issue access requests using a dedicated file access protocol to the file storage device in order to access files stored on the file storage device, with the proxy device being arranged so as to intercept access requests issued to the file storage device. The proxy device comprises a first interface for receiving an access request issued by one of the client devices to the file storage device using the dedicated file access protocol, and a second interface for communicating with the file storage device to cause the file storage device to process the access request. Further, processing logic is provided for causing selected malware scanning algorithms to be executed to determine whether the file identified by the access request is to be considered as malware. This approach removes the dependency of the malware scanning process on the operating system and/or vendor of the file storage device.

Techniques for performing malware scanning of files stored within a file storage device of a computer network

The present invention provides a load balancing device, computer program product, and method for balancing the load across a plurality of proxy devices arranged to perform malware scanning of files stored within a file storage device of a computer network. The computer network has a plurality of client devices arranged to issue access requests using a dedicated file access protocol to the file storage device in order to access files stored on the file storage device. The load balancing device is arranged so as to intercept access requests issued to the file storage device, and comprises a client interface for receiving an access request issued to the file storage device using the dedicated file access protocol. Further, the load balancing device comprises load balancing logic for applying a predetermined load balancing routine to determine to which proxy device to direct the received access request, and a proxy device interface for sending the access request to the proxy device determined by the load balancing logic, each proxy device being coupled to the file storage device. This enables a very efficient system to be developed for performing malware scanning of files stored within the file storage device, whilst enabling that system to be developed independently of the particular file storage device being used in the computer network, or the operating system being run on that file storage device.

Handling of malware scanning of files stored within a file storage device of a computer network

When a file is created on a computer, an archive copy of that file is also created and separately stored. Upon a subsequent access to the active copy of that file, a comparison between the active copy and the full archived copy is made to detect any changes. If there are not any changes, then the active copy of the file is assumed to be clean from malicious alteration and the access request is permitted. If an alteration has been made and is detected, then further countermeasures are triggered, such as full virus scanning of that file or blocking of its use. This archiving and comparison technique may be selectively applied to a subset of file types, such as executable files and dynamic link libraries, which are known to be infrequently modified during normal user operations.

Detecting malicious alteration of stored computer files

A network bridge () has an associated malware scanner () that serves to concatenate portions of a data file from within data packets intercepted by the network bridge () and then scan the data file concerned before the data file is forwarded to its intended recipient by the network bridge (). The network bridge () may be inserted in a network topology without requiring significant network configuration changes. The network bridge () may include a packet analysis unit () that serves to intercept only data packets having a predetermined network layer protocol or a predetermined application layer protocol.

Malware scanning using a network bridge

A source computerhaving a copy of a computer file that it is desired to download to a plurality of target computers issues broadcast messages via a computer network linked to those target computers. The broadcast messages indicate the availability of the computer file for download and include a download qualifying parameter. The download qualifying parameter is used by receiving target computers to determine whether or not they qualify to attempt a download from the source computer in response to the received broadcast message. Only those target computers that do qualify attempt a download. The source computer monitors how many target computers make a download attempt in response to a particular broadcast message and adjusts the download qualifying parameters in subsequent broadcast messages so that the target computers progressively download the new computer file without overloading the source computer.

Downloading a computer file from a source computer to a target computer

A system for scanning computer files for unwanted properties, such as containing computer viruses or being spam e-mail, allocates a priority to pending scan requests based upon the identity of a computer user associated with the scan request. In the case of a normal file access request, the computer user associated with the scan request may be the file access request or in the case of an on-demand scan, then the computer user associated with a particular scan request for a computer file may be the owner or creator of that computer file. In the case of scan requests associated with e-mails, the sender or recipient computer user may be used in the allocation of a priority level for the scan request.

Authorizing an additional computer program module for use with a core computer program

A computer virus scanning system is described in which during the scanning operation a measurement value indicative of the amount of data processing performed is calculated and this measurement value used to trigger breaks in the virus scanning operation. The triggered breaks can be used to perform a determination as to whether or not the virus scanning operations should be early terminated. One possibility is to measure the total size of the data processed during the virus scanning operation and calculate a ratio of this compared to the size of the computer file being virus scanned. If this calculated ratio exceeds a predetermined threshold, then virus scanning may be terminated. Another possibility is to associate a complexity value with each of a plurality of tests applied in the virus scanning operation. A total for these complexity values may be used to trigger the breaks and also to trigger early termination upon exceeding of respective threshold levels.

Providing break points in a malware scanning operation

A scan of computer files for predefined properties indicative of such things as viruses is disclosed. The scan is performed in a circular manner, such that when all of the files to be scanned have been scanned it starts again from the first file. The ability to update the data defining the properties to be scanned for during a scan is provided.

Growing community of inventors

Aylesbury, United Kingdom

Daniel Joseph Wolff