On Demand Virus Scan

• US 20080141375A1
• Filed: 12/07/2006
• Published: 06/12/2008
• Est. Priority Date: 12/07/2006
• Status: Active Grant

• Current Assignee: Taasera Licensing LLC (Quest Patent Research Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Amundsen, Lance C.
• Granted Patent: US 8,572,738 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

A method and apparatus are provided for performing periodic virus scans on a computer system that mitigates utilization of system resources. All objects designated as non-recently used are placed in an archived format and rendered un-executable. The archived objects are omitted from periodic virus scans. At such time as a request for an archive object is received, or access to an archived object is otherwise required, the archived object is converted to a non-archived state. In addition, before the returned object is made available to a requester, the recently converted object is subject to a virus scan on-demand. Accordingly, the periodic virus scan omits all archived objects, which will only be subject to a virus scan upon receipt of request to the archived object.

Claims

1. A computer implemented method for detecting a computer virus, comprising:

identifying a group of non-recently used objects;

archiving the identified objects, wherein the step of archiving said objects renders all objects in said archived state un-executable;

searching for presence of a virus, including periodically scanning for a virus on all non-archived objects while bypassing all archived objects; and

granting access to said scanned object if it is determined that a virus is absent, and denying access to said scanned object if it is determined that a virus is present.

2. The method of claim 1, further comprising converting archived object to a non-archived object responsive to a request for access to said archived object, and performing a scan of said un-archived object to determine presence of a virus in said object.

3. The method of claim 2, wherein the step of performing a scan of said converted object is conducted in real-time.

4. The method of claim 2, wherein the step of performing a scan of said converted object is responsive to an access request to said archived object.

5. The method of claim 4, further comprising restricting said virus scan to said converted object.

6. The method of claim 5, further comprising executing said converted and scanned object if said object is executable code and if it is determined that a virus is absent from said object.

7. The method of claim 6, further comprising granting access to said converted and scanned object if said object is non-executable code and if it is determined that a virus is absent from said object.

8. The method of claim 6, further comprising denying access to said converted object if it is determined that a virus is present.

9. A system comprising:

a processor in communication with storage media;

an object in communication with said storage media designated as non-recently used;

an archive tool in communication with said storage media to archive said non-recently used object;

a virus scan tool in communication with said processor and said storage media to scan for a virus on all non-archived objects in communication with said storage media, and to bypass all archived objects; and

said virus scan tool to periodically search for presence of a virus in all non-archived objects, and to deny access of said processor to said object if a virus is present and to grant access of said processor to said object if a virus is absent from said object.

10. The system of claim 9, further comprising said archive tool to convert an archived object to a non-archive format in response to receipt of a request from said processor to access said archived object, and for said virus scan tool to search said converted object for presence of a virus in said object.

11. The system of claim 10, wherein said search of said converted object for a virus is conducted in real-time.

12. The system of claim 10, wherein said search of said converted object for a virus is conducted in response to an access request to said archived object.

13. The system of claim 12, further comprising a restriction of said virus scan tool to said converted object.

14. The system of claim 13, further comprising execution of said converted and scanned object if said object is executable code and if it is determined that a virus is absent from said object.

15. The system of claim 13, further comprising a granting of access to said converted and scanned object if said object is non-executable code and if it is determined that a virus is absent from said object.

16. The system of claim 13, further comprising a denial of access to said converted object if it is determined that a virus is present.

17. An article comprising:

a tangible computer readable carrier including computer program instructions configured to cause a computer to detect presence of a virus in an object in communication with storage media, comprising;

instructions to designate a group of non-recently used objects;

instructions to archive the designated group of objects, wherein the step of archiving said objects renders all objects in said archived state un-executable;

configuring a set of instructions to scan for a virus on all non-archived objects and to bypass all archived objects during said scan; and

instructions to determine presence of a virus in an object, including granting access to said scanned object if it is determined that a virus is absent, and denying access to said scanned object if it is determined that a virus is present.

18. The article of claim 17, further comprising instructions to convert an archived object responsive to a request for access to said archived object, and to perform a scan of said converted object to determine presence of a virus in said object.

19. The article of claim 17, wherein the instructions to perform a scan of said converted object is conducted in real-time.

20. The article of claim 18, wherein the instructions to perform a scan of said converted object is responsive to an access request to said archived object.

21. The article of claim 20, further comprising instructions to restrict said virus scan to said converted object.

22. The article of claim 21, further comprising instructions to execute said converted and scanned object if said object is executable code and if it is determined that a virus is absent from said object.

23. The article of claim 22, further comprising instructions to grant access to said converted and scanned object if said object is non-executable code and if it is determined that a virus is absent from said object.

24. The article of claim 22, further comprising instructions to deny access to said converted object if it is determined that a virus is present.

25. A computer system comprising:

a processor in communication with an operating system and storage media;

an archive tool in communication with said operating system to convert a non-recently used object into an archived format;

a virus detection tool in communication with said operating system to scan all non-archived objects in said storage media for presence of a virus on a periodic basis, wherein said scan is limited to non-archived objects.

26. The system of claim 25, further comprising an access request for said archived object communicated to said operating system, said archive tool to restore said archived object to a non-archived format in response to receipt of said access request, and said virus detection tool to scan said restored object in said access request to determine presence of a virus.

27. The system of claim 26, wherein said virus scan tool determination is limited to said restored object.

28. The system of claim 26, wherein said virus scan of said restored object is conducted in real-time.

29. An article comprising:

a tangible computer readable carrier including computer program instructions configured to cause a computer to detect a computer virus, comprising;

instructions to convert a non-recently used object into a non-executable format in storage media; and

instructions responsive to an access request to said non-executable format object, to restore said non-executable format object to an executable format, and to determine presence of a virus in said object.

30. The article of claim 29, further comprising instructions to convert non-recently used objects into a non-executable format when said object has not been accessed for a defined time interval.

31. The article of claim 29, wherein said instructions to determine presence of a virus in said restored object is limited to determining presence of a virus in said restored objects.

32. The article of claim 29, further comprising instructions to grant access to said restored object if a virus is absent from said restored object.

33. The article of claim 29, further comprising instructions to deny access to said restored object if a virus is present in said restored object.