Blocking replication of e-mail worms

• US 20040117641A1
• Filed: 12/17/2002
• Published: 06/17/2004
• Est. Priority Date: 12/17/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Kennedy, Mark, Renert, Charles
• Granted Patent: US 7,631,353 B2
• Time in Patent Office: Days
• US Class Current: 713/188
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files

Abstract

Computer-implemented methods, apparati, and computer-readable media for blocking the replication of computer worms in a computer (10). A method of the present invention comprises the steps of: for an e-mail program (1) installed on the computer (10), finding (22) the location of a temporary holding area (2) used by the e-mail program (1) for storing and opening e-mail attachments; monitoring (23) the temporary holding area (2) for openings of target programs (3) stored within the temporary holding area (2); and upon the opening of a target program (3) for execution, implementing (24) a worm mitigation procedure.

Claims

1. A computer-implemented method for blocking the replication of computer worms in a computer, said method comprising the steps of:

for an e-mail program installed on the computer, finding the location of a temporary holding area used by the e-mail program for storing and opening e-mail attachments;

monitoring the temporary holding area for openings of target programs stored within the temporary holding area; and

upon the opening of a target program for execution, implementing a worm mitigation procedure.

2. The computer-implemented method of claim 1 wherein the worm mitigation procedure comprises preventing the target program from opening itself as data.

3. The computer-implemented method of claim 2 wherein a user of the computer is alerted when the target program attempts to open itself as data.

4. The computer-implemented method of claim 2 further comprising the step of executing a false positive mitigation procedure, wherein the target program is allowed to open itself as data when said opening is deemed by the false positive mitigation procedure to be a false positive.

5. The computer-implemented method of claim 4 wherein a false positive is found based upon the occurrence of at least one of the following:

the target program is a self-extractor;

the target program has a valid digital signature affixed thereto;

the target program passes an additional test selected by the false positive mitigation procedure.

6. The computer-implemented method of claim 2 further comprising the step of processing the target program when the target program attempts to open itself as data.

7. The computer-implemented method of claim 1 wherein the worm mitigation procedure comprises preventing any program anywhere on the computer from opening the target program as data.

8. The computer-implemented method of claim 7 wherein a user of the computer is alerted when any program anywhere on the computer attempts to open the target program as data.

9. The computer-implemented method of claim 7 further comprising the step of executing a false positive mitigation procedure, wherein the target program is allowed to be opened as data when said opening is deemed by the false positive mitigation procedure to be a false positive.

10. The computer-implemented method of claim 9 wherein a false positive is found based upon the occurrence of at least one of the following:

the target program is a self-extractor;

the target program has a valid digital signature affixed thereto;

the target program passes an additional test selected by the false positive mitigation procedure.

11. The computer-implemented method of claim 7 further comprising the step of processing the target program when any program anywhere on the computer attempts to open the target program as data.

12. The computer-implemented method of claim 1 wherein the worm mitigation procedure comprises preventing the target program from accessing port 25.

13. The computer-implemented method of claim 12 wherein a user of the computer is alerted when the target program attempts to access port 25.

14. The computer-implemented method of claim 12 further comprising the step of executing a false positive mitigation procedure when the target program attempts to access port 25, wherein the target program is allowed to access port 25 when said accessing is deemed by the false positive mitigation procedure to be a false positive.

15. The computer-implemented method of claim 14 wherein a false positive is found based upon the occurrence of at least one of the following:

a valid digital signature is affixed to the target program;

the target program passes an additional test selected by the false positive mitigation procedure.

16. The computer-implemented method of claim 12 wherein the target program is allowed to pass through port 25, but attachments to the target program are not allowed to pass through port 25.

17. The computer-implemented method of claim 12 further comprising the step of processing the target program when the target program attempts to access port 25.

18. The computer-implemented method of claim 1 wherein the worm mitigation procedure comprises blocking all e-mail programs on the computer from opening any executable program on the computer as data during the time period that the target program is executing out of the temporary holding area.

19. The computer-implemented method of claim 18 further comprising the step of alerting a user of the computer when the target program opens for execution out of the temporary holding area.

20. The computer-implemented method of claim 18 further comprising the steps of:

executing a false positive mitigation procedure; and

allowing e-mail programs on the computer to open executable programs on the computer as data during the time period that the target program is executing out of the temporary holding area, when said opening is deemed by the false positive mitigation procedure to be a false positive.

21. The computer-implemented method of claim 20 wherein a false positive is found based upon the occurrence of at least one of the following:

a valid digital signature is affixed to the target program;

the target program passes an additional test selected by the false positive mitigation procedure.

22. The computer-implemented method of claim 18 further comprising the step of processing the target program when the target program opens for execution.

23. The computer-implemented method of claim 1 further comprising the step of:

before performing the method steps of claim 1, locating all e-mail programs installed on the computer;

wherein

the method steps of claim 1 are performed for each e-mail program installed on the computer.

24. Apparatus for blocking he replication of computer worms in a computer, said apparatus comprising:

means for finding a temporary holding area used for storing and opening e-mail attachments by an e-mail program installed on the computer;

coupled to the temporary holding area, a file system filter driver adapted to monitor openings of target programs stored within the temporary holding area; and

coupled to the file system filter driver, a worm mitigation module adapted to execute upon the occurrence of a target program opening for execution.

25. The apparatus of claim 24 further comprising:

coupled to the means for finding a temporary holding area, means for locating all e-mail programs installed on the computer.

26. A computer-readable medium containing computer program instructions for blocking the replication of computer worms in a computer, said computer program instructions performing the steps of:

for an e-mail program installed on the computer, finding the location of a temporary holding area used by the e-mail program for storing and opening e-mail attachments;

monitoring the temporary holding area for openings of target programs stored within the temporary holding area; and

upon the opening of a target program for execution, implementing a worm mitigation procedure.

27. The computer-readable medium of claim 26 wherein the worm mitigation procedure comprises processing the target program.

28. The computer-readable medium of claim 27 wherein processing the target program comprises deleting the target program from the computer.

29. The computer-readable medium of claim 27 wherein processing the target program comprises blocking execution of a method being performed by the target program.

30. The computer-readable medium of claim 27 wherein processing the target program comprises blocking a method being performed by the target program and quarantining the target program.

31. The computer-readable medium of claim 27 wherein processing the target program comprises attempting a repair of the target program and, when the repair is successful, allowing the method being performed by the target program to proceed.

32. The computer-readable medium of claim 27 wherein processing the target program comprises allowing a method being performed by the target program to proceed, upon instructions received from a user of the computer.

33. The computer-readable medium of claim 26 wherein said computer program instructions perform the step of:

before performing the method steps of claim 26, locating all e-mail programs installed on the computer;

wherein

the method steps of claim 26 are performed for each e-mail program installed on the computer.