Method and apparatus for providing a business service for the detection, notification, and elimination of computer viruses

• US 20020116639A1
• Filed: 02/21/2001
• Published: 08/22/2002
• Est. Priority Date: 02/21/2001
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Mohindra, Ajay, Mastrianni, Steven J., Chefalas, Thomas E.
• Application Number:
  US09/789,867
• Publication Number:
  US 20020116639A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A method, apparatus, and computer implemented instructions for handling a virus in a network data processing system. A client data processing system monitors for the virus. In response to detecting the virus, the client data processing system sends notification of a presence of the virus on the data processing system to a server, wherein the notification includes an identification of an action taken in response to detecting the virus. Further, the client data processing system may take actions to eliminate or quarantine the virus. In a server data processing system, a notification of a presence of a virus on a client data processing system is received through a communications link. The communication with the client data processing system through the communications link is severed in response to receiving the notification. Virus removal processes may be executed on the server data processing system. Alternatively or additionally, the server data processing system may execute an action based on a business policy in response to receiving the notification.

Claims

1. A method in a data processing system for handling a virus, the method comprising:

monitoring for the virus; and

responsive to detecting the virus, sending a notification of a presence of the virus on the data processing system to a server, wherein the notification includes an identification of an action taken in response to detecting the virus.

2. The method of claim 1, wherein the action is an absence of any action.

3. The method of claim 1, wherein the action is a removal of the virus file in the data processing system.

4. The method of claim 1, wherein the notification includes an identification of the virus.

5. The method of claim 1, wherein the data processing system is a client to the server.

6. A method in a server data processing system for handling a virus, the method comprising:

receiving a notification of a presence of the virus on a client data processing system through a communications link;

severing communication with the client data processing system through the communications link in response to receiving the notification; and

executing virus removal processes on the server data processing system.

7. The method of claim 6 further comprising:

shutting down the server data processing system.

8. The method of claim 6 further comprising:

removing network shares under the control of the server data processing system.

9. The method of claim 6, wherein a set of clients are present and further comprising:

disabling communications links to the set of clients.

10. The method of claim 6 further comprising:

reestablishing communication with the client after virus removal processes have been executed.

11. The method of claim 6 further comprising:

blocking access to a shared resource.

12. The method of claim 11, wherein the shared resource is one of a storage device, an output device, a file, and a drive.

14. The method of claim 13, wherein the action is to execute the virus removal process on the server data processing system.

15. The method of claim 13, wherein the action is at least one of paging a technician, sending a call to a manager, scheduling servers for the client data processing system.

16. The method of claim 13, wherein the policy includes rules identifying actions based on an identification of the client data processing system.

17. The method of claim 13, wherein the policy includes rules identifying actions based on a date on which the notification is received.

18. The method of claim 13, wherein the policy includes rules identifying actions based on a time at which the notification is received.

19. The method of claim 13, wherein the policy includes rules identifying actions based on a function performed by the client data processing system.

13. A method in a server data processing system for handling a presence of a virus in a network data processing system, the method comprising:

receiving a notification of a presence of the virus on a client data processing system; and

executing an action based on a business policy in response to receiving the notification.

20. A data processing system comprising:

a bus system;

a communications unit connected to the bus, wherein data is sent and received using the communications unit;

a memory connected to the bus system, wherein a set of instructions are located in the memory; and

a processor unit connected to the bus system, wherein the processor unit executes the set of instructions to monitor for a virus; and

send a notification of a presence of the virus on the data processing system to a server in response to detecting the virus, wherein the notification includes an identification of an action taken in response to detecting the virus.

21. The data processing system of claim 20, wherein the bus system includes a primary bus and a secondary bus.

22. The data processing system of claim 20, wherein the processor unit includes a single processor.

23. The data processing system of claim 20, wherein the processor unit includes a plurality of processors.

24. The data processing system claim 20, wherein the communications unit is an Ethernet adapter.

25. The data processing system of claim 20, wherein the action is an absence of any action.

26. The method of claim 20, wherein the action is a removal of the virus a file in the data processing system.

27. The method of claim 20, wherein the notification includes an identification of the virus.

28. The method of claim 20, wherein the data processing system is a client to the server.

30. The server data processing system of claim 29, wherein the processor unit further executes instructions to shut down the server data processing system.

31. The server data processing system of claim 29 wherein the processor unit further executes instructions to remove network shares under the control of the server data processing system.

32. The server data processing system of claim 29, wherein a set of clients are present and wherein the processor unit further executes instructions to disable communications links to the set of clients.

33. The server data processing system of claim 29 wherein the processor unit further executes instructions to reestablish communication with the client after virus removal processes have been executed.

34. The server data processing system of claim 29 wherein the processor unit further executes instructions to block access to a shared resource.

35. The server data processing system of claim 34, wherein the shared resource is one of a storage device, an output device, a file, and a drive.

37. The data processing system of claim 36, wherein the action is to execute the virus removal process on the server data processing system.

38. The data processing system of claim 36, wherein the action is at least one of paging a technician, sending a call to a manager, scheduling servers for the client data processing system.

39. The data processing system of claim 36, wherein the policy includes rules identifying actions based on an identification of the client data processing system.

40. The data processing system of claim 36, wherein the policy includes rules identifying actions based on a date on which the notification is received.

41. The data processing system of claim 36, wherein the policy includes rules identifying actions based on a time at which the notification is received.

42. The data processing system of claim 36, wherein the policy includes rules identifying actions based on a function performed by the client data processing system.

29. A server data processing system comprising:

a bus system;

a communications unit connected to the bus, wherein data is sent and received using the communications unit;

a memory connected to the bus system, wherein a set of instructions are located in the memory; and

a processor unit connected to the bus system, wherein the processor unit executes the set of instructions to receive a notification of a presence of a virus on a client data processing system through a communications link;

sever communication with the client data processing system through the communications link in response to receiving the notification; and

execute virus removal processes on the server data processing system.

36. A data processing system comprising:

a bus system;

a communications unit connected to the bus, wherein data is sent and received using the communications unit;

a memory connected to the bus system, wherein a set of instructions are located in the memory; and

a processor unit connected to the bus system, wherein the processor unit executes the set of instructions to receive a notification of a presence of a virus on a client data processing system; and

execute an action based on a business policy in response to receiving the notification.

43. A data processing system for handling a virus, the data processing system comprising:

monitoring means for monitoring for the virus; and

sending means, responsive to detecting the virus, for sending a notification of a presence of the virus on the data processing system to a server, wherein the notification includes an identification of an action taken in response to detecting the virus.

44. The data processing system of claim 43, wherein the action is an absence of any action.

45. The data processing system of claim 43, wherein the action is a removal of the virus a file in the data processing system.

46. The data processing system of claim 43, wherein the notification includes an identification of the virus.

47. The data processing system of claim 43, wherein the data processing system is a client to the server.

49. The data processing system of claim 48 further comprising:

shutting downing means for shutting down the server data processing system.

50. The data processing system of claim 48 further comprising:

removing means for removing network shares under the control of the server data processing system.

51. The data processing system of claim 48, wherein a set of clients are present and further comprising:

disabling means for disabling communications links to the set of clients.

52. The data processing system of claim 48 further comprising:

reestablishing means for reestablishing communication with the client after virus removal processes have been executed.

53. The data processing system of claim 48 further comprising:

blocking means for blocking access to a shared resource.

54. The data processing system of claim 53, wherein the shared resource is one of a storage device, an output device, a file, and a drive.

48. A data processing system for handling a virus, the data processing system comprising:

receiving means for receiving a notification of a presence of a virus on a client data processing system through a communications link;

severing means for severing communication with the client data processing system through the communications link in response to receiving the notification; and

executing means for executing virus removal processes on the server data processing system.

55. A data processing system for handling a presence of a virus in a network data processing system, the data processing system comprising:

receiving means for receiving a notification of a presence of a virus on a client data processing system; and

executing means for executing an action based on a business policy in response to receiving the notification.

56. The data processing system of claim 55, wherein the action is to execute a virus removal process on the server data processing system.

57. The data processing system of claim 55, wherein the action is at least one of paging a technician, sending a call to a manager, scheduling servers for the client data processing system.

58. The data processing system of claim 55, wherein the policy includes rules identifying actions based on an identification of the client data processing system.

59. The data processing system of claim 55, wherein the policy includes rules identifying actions based on a date on which the notification is received.

60. The data processing system of claim 55, wherein the policy includes rules identifying actions based on a time at which the notification is received.

61. The data processing system of claim 55, wherein the policy includes rules identifying actions based on a function performed by the client data processing system.

62. A computer program product in a computer readable medium for handling a virus, the computer program product comprising:

first instructions for monitoring for the virus; and

second instructions, responsive to detecting the virus, for sending a notification of a presence of the virus on the data processing system to a server, wherein the notification includes an identification of an action taken in response to detecting the virus.

63. A computer program product in a computer readable medium for handling a virus, the computer program product comprising:

first instructions for receiving a notification of a presence of the virus on a client data processing system through a communications link;

second instructions for severing communication with the client data processing system through the communications link in response to receiving the notification; and

third instructions for executing virus removal processes on the server data processing system.

64. A computer program product in a computer readable medium for handling a presence of a virus in a network data processing system, the computer program product comprising:

first instructions for receiving a notification of a presence of the virus on a client data processing system; and

second instructions for executing an action based on a business policy in response to receiving the notification.

65. A method in a data processing system for handling a virus, the method comprising:

monitoring for the virus; and

responsive to detecting the virus, sending a notification of a presence of the virus on the data processing system to a server, wherein the notification includes one of an identification of an action taken and an identification of an action not taken.

66. The method of claim 65, wherein the action includes one of removing the virus from a file, quarantining a file, or removing the file.