Event reporting between a reporting computer and a receiving computer

Abstract

An event report, such as a virus detection event, is sent from a reporting computerto a receiving computervia an internet link. The report data may take the form of a URL requesting a web pageto be provided by the receiving computer, the URL bearing an encrypted formof the report data that is used to identify the requested web page as well as pass further information to the receiving computer. Alternatively, the report data may be collated in the reporting computerand passed to the receiving computerwhen a computer virus definition data update is requested. The report data seeks to uniquely identify the event by incorporating the MAC address of the reporting computer, the date, time, computer product identifier, version identifier, update identifier and driver triggered. Additionally, a checksum derived from the infected file together with an indication of the corrective action, if any, taken by the reporting computermay be included. The report data sent to the receiving computermay be used to obtain real life information concerning the prevalence of particular viruses together with information characterising the anti-virus programs and their update status being employed by the user community.