File Blocking Mitigation

• US 20080209138A1
• Filed: 02/26/2007
• Published: 08/28/2008
• Est. Priority Date: 02/26/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Pullen, Walter D., Sheldon, Elizabeth Jeanne, Treacy, Ambrose T., Kalra, Bikramjit S., Bailor, Jonathan B., Dandige, Maithili V.
• Granted Patent: US 7,797,742 B2
• Time in Patent Office: Days
• US Class Current: 711/154
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

Embodiments are described for blocking the opening of a file. Some embodiments include receiving a request to open a file. In response, a portion of the file'"'"'s data is examined to determine a true file format for the file. A determination is then made as to whether the true file format of the file has been set as blocked. Based on the determination that the file format is blocked from opening, the file is prevented from being loaded into memory and from being accessed. A message is then displayed to a user indicating that the file has been blocked from opening.

Claims

1. A method of blocking the opening of a file, the method comprising:

receiving a request to open a file;

examining a portion of the file'"'"'s data to determine a true file format for the file;

determining whether the true file format is of a format that is blocked from being opened;

based on the determining, blocking the opening of the file by preventing the loading of the file into memory and preventing access to the file; and

displaying a message indicating that the file has been blocked from opening.

2. The method of claim 1, wherein the examining, determining, blocking, and displaying is performed by an application that is capable of opening the file by loading the file into memory and providing access to the file.

3. The method of claim 1, wherein a file extension is not used to determine the true file format.

4. The method of claim 3, wherein the examining comprises identifying features within the portion of the file'"'"'s data that indicate the true file format.

5. The method of claim 4, wherein the features include header information and data structures.

6. The method of claim 1, wherein the determining comprises accessing an open block policy indicating a file type that is blocked from being opened, the true file format being associated with the file type.

7. The method of claim 6, wherein the open block policy is stored in a registry comprising a registry key for the file type.

8. The method of claim 1, further comprising after the receiving, determining whether the file is stored in a trusted location.

9. The method of claim 8, wherein in response to a determination that the file is stored in a trusted location:

bypassing the examining, determining, blocking, and displaying steps; and

opening the file by loading the file into memory and allowing access to the file.

14. The computer readable medium of claim 9, wherein the determining comprises accessing an open block policy indicating a file type that is blocked from being opened, the true file format being associated with the file type.

15. The computer readable medium of claim 14, wherein the open block policy is stored in a registry comprising a registry key for the file type.

16. The computer readable medium of claim 15, wherein the trusted location is designated by an administrator in a registry key within the registry.

10. A computer readable medium encoding instructions for performing a method of opening a file, the method comprising:

receiving by an application a request to open a file;

determining whether the file is stored in a trusted location;

in response to a determination that the file is stored in a trusted location , the application opening the file by loading the file into memory and allowing access to the file; and

in response to a determination that the file is not stored in a trusted location;

examining a portion of the file'"'"'s data to determine a true file format for the file;

determining whether the true file format is of a format that is blocked from being opened;

if the file is not of a type that is blocked from being opened, the application opening the file by loading the file into memory and allowing access to the file; and

if the file is of a type that is blocked from being opened, displaying a message indicating that the file has been blocked from opening.

11. The computer readable medium of claim 10, wherein a file extension is not used to determine the true file format.

12. The computer readable medium of claim 11, wherein the examining comprises identifying features within the portion of the file'"'"'s data that indicate the true file format.

13. The computer readable medium of claim 12, wherein the features include header information and data structures.

17. A method of blocking the saving of a file, the method comprising:

receiving a request to save a file as a true file format;

determining whether the true file format is of a format that is blocked from being opened;

based on the determining, blocking the saving of the file; and

displaying a message indicating that the file has been blocked from saving.

18. The method of claim 17, wherein if the request is received as part of an auto save operation:

bypassing the determining, blocking, and displaying steps; and

saving the file in the true file format; and

if the request is not received as part of an auto save operation, performing the determining, blocking, and displaying steps.

19. The method of claim 17, wherein the determining comprises accessing a save block policy indicating a file type that is blocked from being saved, the true file format being associated with the file type.

20. The method of claim 19, wherein the save block policy is stored in a registry comprising a registry key for the file type.