Detecting and remedying unauthorized computer programs

• US 20060101277A1
• Filed: 11/17/2004
• Published: 05/11/2006
• Est. Priority Date: 11/10/2004
• Status: Abandoned Application

• Current Assignee: America Online Inc. (Warner Bros. Discovery, Inc.)
• Original Assignee: America Online Inc. (Warner Bros. Discovery, Inc.)
• Inventors: Kotay, Sreekant, Meenan, Patrick A., Levy-Yurista, Guy, Shomaker, Renee, Chiles, Anthony A.
• Application Number:
  US10/989,605
• Publication Number:
  US 20060101277A1
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS

Abstract

To protect a client system from unauthorized programs, a scanner application for detecting particular unauthorized programs is maintained on a host system and periodically provided to a client system that executes the scanner application. Targeted solutions to particular types of unauthorized programs also are maintained on the host system and provided to the client system. If the scanner application detects an unauthorized program on the client system, a remedy that is targeted only to the detected unauthorized program is programmatically initiated to remedy the problem of the detected unauthorized program.

Claims

1. A method for protecting a client system from unauthorized programs, the method comprising:

providing a client, in a communication session between the client system and a host system, with a scanning application to detect the presence of an unauthorized program on the client system; and

in response to detection of the presence of an unauthorized program, executing, at the client system, a remedy for the detected unauthorized program wherein the remedy is provided, in the communication session, to the client system from the host system.

2. The method of claim 1 further comprising transmitting, in the communication session, to the client system from the host system the remedy in response to detection of the presence of the unauthorized program.

3. The method of claim 1 wherein detection of the presence of an unauthorized program comprises detection of current residence in memory of the client system of the unauthorized program.

4. The method of claim 1 wherein detection of the presence of an unauthorized program comprises detection of current operation of the unauthorized program at the client system.

5. The method of claim 1 wherein providing a scanning application comprises providing a scanning application to be run in active memory and not to be stored on non-volatile storage of the client system.

6. The method of claim 1 wherein providing a scanning application comprising providing a first scanning application to be run in active memory of the client system and a second scanning application stored on non-volatile storage of the client system.

7. The method of claim 1 wherein the scanning application is a first scanning application, the method further comprising making available to the client system a second scanning application that provides multiple remedies for multiple types of unauthorized programs, wherein:

the second scanning application is stored on non-volatile storage of the client system,

the second scanning application is substantially larger than the first scanning application, and

the multiple remedies provided by the second scanning application include remedies for types of unauthorized program other than the remedy for the detected unauthorized program executed in response to detection of the presence of unauthorized program by the first scanning application.

8. The method of claim 1 further comprising:

detecting establishment of the communication session between the client system and the host system; and

providing the scanning application to the client system in response to detection of the establishment of the communication session.

9. The method of claim 8 wherein detecting establishment of the communication session between the client system and the host system comprises detecting that a user of the client system has signed onto the host system.

10. The method of claim 1 further comprising enabling scanning of the client system to detect the presence of a form of unauthorized program on the client system.

11. The method of claim 10 wherein scanning of the client system comprises periodic scanning of the client system during the communication session.

12. The method of claim 10 wherein scanning of the client system comprises scanning only the random access memory of the client system to detect presence of a form of unauthorized program on the client system.

13. The method of claim 1 wherein the scanning application is only resident in random access memory of the client system.

14. The method of claim 1 wherein the scanning application comprises code segments stored in non-volatile storage medium to detect particular unauthorized programs.

15. A computer-readable medium or propagated signal having embodied thereon a computer program configured to protect a client system from unauthorized programs, the medium or signal comprising one or more code segments configured to:

provide a client, in a communication session between the client system and a host system, with a scanning application to detect the presence of an unauthorized program on the client system; and

in response to detection of the presence of an unauthorized program, execute, at the client system, a remedy for the detected unauthorized program wherein the remedy is provided, in the communication session, to the client system from the host system.

16. The medium of claim 15 wherein the one or more code segments are further configured to transmit, in the communication session, to the client system from the host system the remedy in response to detection of the presence of the unauthorized program.

17. The medium of claim 15 wherein detection of the presence of an unauthorized program comprises detection of current residence in memory of the client system of the unauthorized program.

18. The medium of claim 15 wherein detection of the presence of an unauthorized program comprises detection of current operation of the unauthorized program at the client system.

19. The medium of claim 15 wherein the one or more code segments configured to provide a scanning application comprise one or more code segments configured to provide a scanning application to be run in active memory and not to be stored on non-volatile storage of the client system.

20. The medium of claim 15 wherein the one or more code segments are further configured to provide a first scanning application to be run in active memory of the client system and a second scanning application stored on non-volatile storage of the client system.

21. The medium of claim 15 wherein:

the scanning application is a first scanning application, and

the one or more code segments are further configured to make available to the client system a second scanning application that provides multiple remedies for multiple types of unauthorized programs, wherein;

the second scanning application is stored on non-volatile storage of the client system,

the second scanning application is substantially larger than the first scanning application, and

the multiple remedies provided by the second scanning application include remedies for types of unauthorized program other than the remedy for the detected unauthorized program executed in response to detection of the presence of unauthorized program by the first scanning application.

22. The medium of claim 15 wherein the one or more code segments are further configured to:

detect establishment of the communication session between the client system and the host system, and

provide the scanning application to the client system in response to detection of the establishment of the communication session.

23. The medium of claim 15 wherein the one or more code segments are further configured to scan the client system to detect the presence of a form of unauthorized program on the client system.

24. The medium of claim 15 wherein the scanning application is only resident in random access memory of the client system.

25. The medium of claim 15 wherein the scanning application comprises code segments stored on non-volatile storage medium to detect particular unauthorized programs.

26. An apparatus protecting a client system from unauthorized programs, the apparatus being configured to:

provide a client, in a communication session between the client system and a host system, with a scanning application to detect the presence of an unauthorized program on the client system; and

in response to detection of the presence of an unauthorized program, execute, at the client system, a remedy for the detected unauthorized program wherein the remedy is provided, in the communication session, to the client system from the host system.

27. The apparatus of claim 26 further configured to transmit, in the communication session, to the client system from the host system the remedy in response to detection of the presence of the unauthorized program.

28. The apparatus of claim 26 wherein detection of the presence of an unauthorized program comprises detection of current residence in memory of the client system of the unauthorized program.

29. The apparatus of claim 26 wherein detection of the presence of an unauthorized program comprises detection of current operation of the unauthorized program at the client system.

30. The apparatus of claim 26 further configured to provide a scanning application to be run in active memory and not to be stored on non-volatile storage of the client system.

31. The apparatus of claim 26 further configured to provide a first scanning application to be run in active memory of the client system and a second scanning application stored on non-volatile storage of the client system.

32. The apparatus of claim 26 wherein the scanning application is a first scanning application, the apparatus further configured to make available to the client system a second scanning application that provides multiple remedies for multiple types of unauthorized programs, wherein:

the second scanning application is stored on non-volatile storage of the client system,

the second scanning application is substantially larger than the first scanning application, and

the multiple remedies provided by the second scanning application include remedies for types of unauthorized program other than the remedy for the detected unauthorized program executed in response to detection of the presence of unauthorized program by the first scanning application.

33. The apparatus of claim 26 further configured to:

detect establishment of the communication session between the client system and the host system; and

provide the scanning application to the client system in response to detection of the establishment of the communication session.

34. The apparatus of claim 26 further configured to scan the client system to detect the presence of a form of unauthorized program on the client system.

35. The apparatus of claim 26 wherein the scanning application is only resident in random access memory of the client system.

36. The apparatus of claim 26 wherein the scanning application comprises code segments stored on non-volatile storage medium to detect particular unauthorized programs.

37. A system for protecting a client system from unauthorized programs, the system comprising:

means for providing a client, in a communication session between the client system and a host system, with a scanning application to detect the presence of an unauthorized program on the client system; and

means for executing, at the client system and in response to detection of the presence of an unauthorized program, a remedy for the detected unauthorized program wherein the remedy is provided, in the communication session, to the client system from the host system.