Detecting Secondary Infections in Virus Scanning

• US 20090320134A1
• Filed: 06/24/2008
• Published: 12/24/2009
• Est. Priority Date: 06/24/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wendzel, Kevin, Corcoran, Sean D., Kalmbach, Michael T., Patterson, Jared W.
• Granted Patent: US 8,695,094 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/562 Static detection

Abstract

A method, computer program product or computer system for scanning files in a computer system to detect additional infected files of a computer virus when a first infected file of the computer virus is identified, includes maintaining a friends tree for each file in the computer system, maintaining a search tree using the friends trees for scanning the files, searching the files listed in the search tree for the additional infected files, and quarantining the additional infected files detected in the searching.

Claims

1. A method for scanning files in a computer system for detecting files infected with a computer virus, comprising:

maintaining a friends tree for each file in the computer system;

seeking a first infected file infected with the computer virus;

maintaining a search tree for the first infected file using the friends trees, when the first infected file is detected;

searching the files listed in the search tree for a second infected file, when the first infected file is detected; and

quarantining the second infected file, when the second infected file is detected in the searching.

2. The method of claim 1, wherein the friends tree of a selected file comprises a list of files that has interacted with the selected file.

3. The method of claim 1, wherein the maintaining a friends tree comprises:

creating a friends tree for a new file when the new file is created;

adding a first file to the friends tree of a second file, if the second file interacts with the first file that the second file has never interacted with before;

pruning the friends tree of a file to remove select files, if the selected files are deleted from the computer system;

pruning the friends tree of a file to remove selected files, when a full system scan has been completed and the selected files are found to be virus free; and

reconnecting sub-trees to form a new friends tree, if an intermediate node is pruned from a friends tree.

4. The method of claim 1, wherein the friends tree is maintained by one of an operating system and an antivirus software.

5. The method of claim 1, wherein the maintaining a search tree comprises:

using the friends tree of the first infected file as the search tree; and

adding a friends tree of a friend of an infected file to the search tree, if the friend is infected with the computer virus.

6. The method of claim 1, wherein the computer system comprises a plurality of computers connected by a computer network.

7. The method of claim 1, wherein the quarantining comprises quarantining the infected files in different levels, each level corresponding to a depth of the search tree.

8. The method of claim 1, further comprises a post-processing step to deal with the detected infected files.

9. A computer program product for scanning files in a computer system for detecting files infected with a computer virus, the computer program product comprising:

a computer usable medium having computer usable program code embodied therewith, the computer usable program code comprising;

instructions to maintain a friends tree for each file in the computer system;

instructions to seek a first infected file infected with the computer virus;

instructions to maintain a search tree for the first infected file using the friends trees, when the first infected file is detected;

instructions to search the files listed in the search tree for a second infected file, when the first infected file is detected; and

instructions to quarantine the second infected file, when the second infected file is detected in the searching.

10. The computer program product of claim 9, wherein the friends tree of a selected file comprises a list of files that has interacted with the selected file.

11. The computer program product of claim 9, wherein the instructions to maintain a friends tree comprises:

instructions to create a friends tree for a new file when the new file is created;

instructions to add a first file to the friends tree of a second file, if the second file interacts with the first file that the second file has never interacted with before;

instructions to prune the friends tree of a file to remove select files, if the selected files are deleted from the computer system;

instructions to prune the friends tree of a file to remove selected files, when a full system scan has been completed and the selected files are found to be virus free; and

instructions to reconnect sub-trees to form a new friends tree, if an intermediate node is pruned from a friends tree.

12. The computer program product of claim 9, wherein the friends tree is maintained by one of an operating system and an antivirus software.

13. The computer program product of claim 9, wherein the instructions to maintain a search tree comprises:

instructions to use the friends tree of the first infected file as the search tree; and

instructions to add a friends tree of a friend of an infected file to the search tree, if the friend is infected with the computer virus.

14. The computer program product of claim 9, wherein the computer system comprises a plurality of computers connected by a computer network.

15. The computer program product of claim 9, wherein the instructions to quarantine comprises instructions to quarantine the infected files in different levels, each level corresponding to a depth of the search tree.

16. The computer program product of claim 9, further comprises instructions to deal with the detected infected files in a post-processing step.

17. A computer system comprising:

a processor;

a memory operatively coupled with the processor;

a storage device operatively coupled with the processor and the memory; and

a computer program product for scanning files in a computer system for detecting files infected with a computer virus, the computer program product comprising;

a computer usable medium having computer usable program code embodied therewith, the computer usable program code comprising;

instructions to maintain a friends tree for each file in the computer system;

instructions to seek a first infected file infected with the computer virus;

instructions to maintain a search tree for the first infected file using the friends trees, when the first infected file is detected;

instructions to search the files listed in the search tree for a second infected file, when the first infected file is detected; and

instructions to quarantine the second infected file, when the second infected file is detected in the searching.

18. The computer system of claim 17, wherein the friends tree of a selected file comprises a list of files that has interacted with the selected file.

19. The computer system of claim 17, wherein the instructions to maintain a friends tree comprises:

instructions to create a friends tree for a new file when the new file is created;

instructions to add a first file to the friends tree of a second file, if the second file interacts with the first file that the second file has never interacted with before;

instructions to prune the friends tree of a file to remove select files, if the selected files are deleted from the computer system;

instructions to prune the friends tree of a file to remove selected files, when a full system scan has been completed and the selected files are found to be virus free; and

instructions to reconnect sub-trees to form a new friends tree, if an intermediate node is pruned from a friends tree.

20. The computer system of claim 17, wherein the friends tree is maintained by one of an operating system and an antivirus software.

21. The computer system of claim 17, wherein the instructions to maintain a search tree comprises:

instructions to use the friends tree of the first infected file as the search tree; and

instructions to add a friends tree of a friend of an infected file to the search tree, if the friend is infected with the computer virus.

22. The computer system of claim 17, wherein the computer system comprises a plurality of computers connected by a computer network.

23. The computer system of claim 17, wherein the instructions to quarantine comprises instructions to quarantine the infected files in different levels, each level corresponding to a depth of the search tree.

24. The computer system of claim 17, further comprises instructions to deal with the detected infected files in a post-processing step.