Symantec Corporation

John Millard

Richard B Sutton

Mark Spiegel

Cassio Goldschmidt

A scanning optimization manager scans files for malicious code. The scanning optimization manager creates listings of the portions of scanned files accessed during the scanning. The scanning optimization manager proceeds to utilize these listings of accessed portions of files as I/O hints to optimize subsequent scans of the files for malicious code.

Efficient file scanning using input-output hints

Methods, apparatuses, and computer-readable media for rapidly traversing movable storage media during file content examination for malicious computer code. An embodiment of the inventive method comprises the steps of: accessing an enumerated list of electronic files () stored on a movable storage medium (); identifying at least one batch of electronic files () stored on the movable storage medium (); associating each electronic file stored on the movable storage medium () within the batch of electronic files with a physical file location on the movable storage medium (); creating a sorted list electronic files by the file's physical location on the movable storage medium (); and examining the identified batch of electronic files on the movable storage medium () according to the sorted list ().

Rapidly traversing disc volumes during file content examination

A scanning optimization manager efficiently scans files for malicious code. The scanning optimization manager maintains a non-tamperable record of modifications to files on a volume. The scanning optimization manager receives at least one malicious code signature. Responsive to the receipt of the at least one malicious code signature, the scanning optimization manager scans at least some files on the volume for the at least one malicious code signature at a priority corresponding to an associated modification status.

Efficient file scanning using secure listing of file modification times

A technique is disclosed for tracking a virus. For each of at least a subset of received network packets it is determined whether the packet comprises an open packet. Information usable to determine a sender of the packet in the event the a virus associated with a network transmission with which the packet is associated is determined to have been received is copied from each packet determined to be an open packet, but not from at least a subset of packets not determined to be open packets.

Tracking computer infections

Computer implemented methods, apparati, and computer-readable media for quickly and safely opening computer files over a network. In a method embodiment of the present invention, a local computer () initiates a test open of a file () associated with a remote computer () that is coupled to the local computer () over the network (). When the test open discloses that the remote computer () has an acceptable malicious code scanning means (), the local computer () performs an actual open of the file ().

Opening computer files quickly and safely over a network

A technique is disclosed for tracking a virus. The technique comprises copying information from a first packet; passing through a second packet; saving the copied information; determining whether an infection has been received, wherein the infection is associated with a network transmission, and wherein the network transmission is also associated with the first packet; and retrieving the saved information.

Computer implement methods, apparati, and computer-readable media for enabling a first computer () to determine that it is safe to communicate with a second computer () coupled to the first computer () over a network (). In a method embodiment of the present invention, the first computer () detects () that the second computer () has initiated a test open of a file () associated with the first computer (). When the test open is followed by an actual open command by which the second computer () seeks to actually open the same file (), the first computer () determines () that it is safe to communicate with the second computer ().

Protecting a computer coupled to a network from malicious code infections

System and method for verifying the integrity of contents within a computer file. A security value S is stored within the file. A verification function f is applied against the entire contents of the file including S, where f is a function of S. Results R of the applying step are compared against a preselected value r, where r is not stored within the file. When R equals r, a determination is made that the file has not been modified. f is typically a distributive invertible function such as the Cyclic Redundancy Check (CRC) function known as modulo p, where p is a prime number and is one bit greater than the length of S. Typically, the value of r is zero. Before executing the verification function f, a check generating program is first executed. This check generating program is executed by a computer that is remote from the file, further enhancing the security of the system.

Computer file integrity verification

Apparatus and method for obtaining a security value (50) that enables a calling module (7) to achieve secure access to a called module (5) within a digital computer (1). A distributive invertible function f is selected. f may be the cyclic redundancy check function modulo p, where p is a prime number. A desired residual value r associated with the application of f and a desired size of the security value (50) are also selected. Space is allocated within the called module (5) for storing the security value (50). A portion of the called module (5) is designated as a test block (51). f is applied to a numerical representation of test block (51) to generate a first challenge value CV1. f is applied to a numerical value of the security value (50) and a number representative of the location of the security value (50) within the called module (5) to calculate a second challenge value CV2. n is the number of bits from the beginning of the security value (50) to the end of the called module (5). CV1 and CV2 are typically calculated by called module (5). Calling module (7) then calculates the security value (50) based upon CV1 and CV2, and using f. Called module (5) uses this calculated value of the security value (50) in function f. If this application of f provides the desired residual value r, then it is known that calling module (7) had proper access to called module (5). At this point, one or more functions accessible by called module (5) may be activated. Access codes may be coded within residual value r itself.

Growing community of inventors

Pasadena, CA, United States of America

John Millard