Remote computer virus scanning

• US 20010005889A1
• Filed: 12/21/2000
• Published: 06/28/2001
• Est. Priority Date: 12/24/1999
• Status: Active Grant

• Current Assignee: Withsecure Corporation
• Original Assignee: F-Secure Oyj
• Inventors: Albrecht, Mikael
• Granted Patent: US 7,020,895 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of scanning electronic files for computer viruses comprises identifying at a first node 4 of a computer network 1, electronic files which require to be scanned for computer viruses. The first node 4 initiates a dialogue with a second node 7 of the network 1, the second node comprising a virus scanning application. During the dialogue, the second node 7 identifies to the first node 4 one or more portions of the electronic file required by the virus scanning application. The first node 4 transfers the identified portions to the second node 7 which then carries out a virus scanning operation. The result of this operation is then returned to the first node 4.

Claims

1. A method of scanning electronic files for computer viruses, the method comprising:

identifying at a first node of a computer network, electronic files which require to be scanned for computer viruses;

initiating a dialogue between said first node and a second node of the network, the second node comprising a virus scanning application, during which dialogue the second node identifies to the first node one or more portions of the electronic file required by the virus scanning application; and

transferring the identified portion(s) from the first node to the second node over the network.

2. A method according to

claim 1

and comprising identifying electronic files which require virus scanning, at a plurality of first nodes of the computer network and initiating a dialogue between the first nodes and the said second node when appropriate.

3. A method according to

claim 1

, wherein the first node and the second node are located at respective different locations in the computer network.

4. A method according to

claim 1

, wherein the first node is one of a database server, electronic mail server, an Internet server, a proxy server, or a firewall server.

5. A method according to

claim 1

, wherein the dialogue is carried out using a network protocol carried by IP.

6. A method according to

claim 1

and comprising analysing the file portions received at the second node to determine whether or not the file contains a virus or cannot be guaranteed to not contain a virus, and returning the result to the first node over the network.

7. A method according to

claim 6

and comprising transferring from the second node to the first node data portions to be written into the file to disinfect the file.

8. A method according to

claim 6

and comprising sending instructions from the second node to the first node to inform the first node how to disinfect the file.

9. An anti-virus scanning system for use in scanning electronic files in a computer network, the system comprising:

a first computer having processing means arranged to identify electronic files which should be scanned for computer viruses; and

a second computer having processing means arranged to perform a virus scanning operation,

the first computer further comprising communication means for initiating a dialogue between the first computer and the second computer, during which the second computer identifies to the first computer those portions of the electronic files required by the first computer for performing the virus scanning operation, and for transferring those portions to the second computer.

10. A computer memory encoded with executable instructions representing a computer program for causing a first computer connected to a computer network to:

identify electronic files which require to be scanned for computer viruses;

initiate a dialogue between the first computer and a second computer also connected to the computer network;

receive from the second computer an identification of portions of the electronic file which are required for virus scanning of the electronic files at the second computer; and

transfer the identified portion from the first computer to the second computer.

11. A computer memory encoded with executable instructions representing a computer program for causing a first computer connected to a computer network to:

receive a dialogue initiation request from a second computer also connected to the computer network concerning an electronic file identified by the second computer as requiring a virus scan;

identify to the second computer those portions of the electronic file which are required by the first mentioned computer for performing a virus scanning operation at the first computer; and

receive the identified portions of the electronic file from the first node.

12. A method of disinfecting an electronic file stored at a first node of a computer network, after the file has been identified as containing a virus by a virus scanning engine located at a second network node, the method comprising:

sending from the second node to the first node, data portions to be written into the infected file and/or instructions for disinfecting the file; and

receiving the data portions and/or instructions at the first node and writing the data portions into the infected file and/or carrying out said instructions.

13. A method according to

claim 12

, wherein said first and second nodes are respective computer workstations coupled to a common network.

14. A method according to

claim 13

, wherein the workstation corresponding to the second node is arranged to communicate with a plurality of workstations corresponding to respective second nodes.