Malware scanning to create clean storage locations

• US 20030120952A1
• Filed: 12/26/2001
• Published: 06/26/2003
• Est. Priority Date: 12/26/2001
• Status: Active Grant

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Tarbotton, Lee Codel Lawson, Vignoles, James Malcolm, Barton, Christopher Andrew
• Granted Patent: US 7,266,843 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

Pre-emptive malware scanning of user specified operating system 10, 12 defined storage locations is performed to establish whether those storage locations contain any malware containing computer files. If the storage locations are malware-free, then they are classified as clean storage locations and subsequent read accesses to those storage locations will be permitted without requiring further malware scanning. Writes to clean storage locations will continue to be malware scanned.

Claims

1. A computer program product for controlling a computer to scan computer files for malware, said computer program product comprising:

malware scanning code operable to malware scan all computer files stored within a storage location as addressed by an operating system to identify any computer files stored within said storage location that contain malware;

identification code operable if no computer files containing malware are found in said storage location, to identify said storage location as a clean storage location; and

when subsequently reading a computer file, determination code operable to determine whether or not said computer file is stored within a clean storage location and;

if said computer file is stored within a clean storage location, then permitting reading of said computer file without further malware scanning; and

if said computer file is not stored within a clean storage location, then malware scanning said computer file.

2. A computer program product as claimed in claim 1, wherein said malware scanning of all computer files stored within a storage location is performed upon a set of user specified storage locations from within all storage locations accessible to a user.

3. A computer program product as claimed in claim 1, wherein said malware scanning of all computer files stored within a storage location is performed as a background task.

4. A computer program product as claimed in claim 3, wherein said malware scanning of all computer files stored within a storage location as a background task is performed with more thorough scanning options selected than for on-access scanning applied to computer files not stored within clean storage locations and being accessed by a user.

5. A computer program product as claimed in claim 1, wherein a computer file is malware scanned before being written to a clean storage location.

6. A computer program product as claimed in claim 1, wherein said malware scanning code uses malware definition data to identify malware and, upon updating of said malware definition data to give updated malware definition data, said storage location is no longer identified as a clean storage area until it has been malware scanned using said updated malware definition data and no computer files containing malware are found in said storage location.

7. A computer program product as claimed in claim 6, wherein, when said storage area is being malware scanned with said updated malware definition data, computer files written to said storage location after said storage location was previously identified as a clean storage location are malware scanned before computer files that are unaltered since said storage location was previously identified as a clean storage location.

8. A computer program product as claimed in claim 1, wherein said malware is one or more of a computer virus, a worm, a Trojan, a banned computer file, a banned word and a banned image.

9. A method of scanning computer files for malware, said method comprising the steps of:

malware scanning all computer files stored within a storage location as addressed by an operating system to identify any computer files stored within said storage location that contain malware;

if no computer files containing malware are found in said storage location, then identifying said storage location as a clean storage location; and

when subsequently reading a computer file, determining whether or not said computer file is stored within a clean storage location, whereupon;

if said computer file is stored within a clean storage location, then permitting reading of said computer file without further malware scanning; and

if said computer file is not stored within a clean storage location, then malware scanning said computer file.

10. A method as claimed in claim 9, wherein said step of malware scanning all computer files stored within a storage location is performed upon a set of user specified storage locations from within all storage locations accessible to a user.

11. A method as claimed in claim 9, wherein said step of malware scanning all computer files stored within a storage location is performed as a background task.

12. A method as claimed in claim 11, wherein said step of malware scanning all computer files stored within a storage location as a background task is performed with more thorough scanning options selected than for on-access scanning applied to computer files not stored within clean storage locations and being accessed by a user.

13. A method as claimed in claim 9, wherein a computer file is malware scanned before being written to a clean storage location.

14. A method as claimed in claim 9, wherein said malware scanning uses malware definition data to identify malware and, upon updating of said malware definition data to give updated malware definition data, said storage location is no longer identified as a clean storage area until it has been malware scanned using said updated malware definition data and no computer files containing malware are found in said storage location.

15. A method as claimed in claim 14, wherein, when said storage area is being malware scanned with said updated malware definition data, computer files written to said storage location after said storage location was previously identified as a clean storage location are malware scanned before computer files that are unaltered since said storage location was previously identified as a clean storage location.

16. A method as claimed in claim 9, wherein said malware is one or more of a computer virus, a worm, a Trojan, a banned computer file, a banned word and a banned image.

17. Apparatus for scanning computer files for malware, said apparatus comprising:

malware scanning logic operable to malware scan all computer files stored within a storage location as addressed by an operating system to identify any computer files stored within said storage location that contain malware;

identification logic operable if no computer files containing malware are found in said storage location, to identify said storage location as a clean storage location; and

when subsequently reading a computer file, determination logic operable to determine whether or not said computer file is stored within a clean storage location and;

if said computer file is stored within a clean storage location, then permitting reading of said computer file without further malware scanning; and

if said computer file is not stored within a clean storage location, then malware scanning said computer file.

18. A computer program product as claimed in claim 17, wherein said malware scanning of all computer files stored within a storage location is performed upon a set of user specified storage locations from within all storage locations accessible to a user.

19. A computer program product as claimed in claim 17, wherein said malware scanning of all computer files stored within a storage location is performed as a background task.

20. A computer program product as claimed in claim 19, wherein said malware scanning of all computer files stored within a storage location as a background task is performed with more thorough scanning options selected than for on-access scanning applied to computer files not stored within clean storage locations and being accessed by a user.

21. A computer program product as claimed in claim 17, wherein a computer file is malware scanned before being written to a clean storage location.

22. A computer program product as claimed in claim 17, wherein said malware scanning logic uses malware definition data to identify malware and, upon updating of said malware definition data to give updated malware definition data, said storage location is no longer identified as a clean storage area until it has been malware scanned using said updated malware definition data and no computer files containing malware are found in said storage location.

23. A computer program product as claimed in claim 22, wherein, when said storage area is being malware scanned with said updated malware definition data, computer files written to said storage location after said storage location was previously identified as a clean storage location are malware scanned before computer files that are unaltered since said storage location was previously identified as a clean storage location.

24. Apparatus as claimed in claim 17, wherein said malware is one or more of a computer virus, a worm, a Trojan, a banned computer file, a banned word and a banned image.