ANTI-VIRUS METHOD, COMPUTER, AND RECORDING MEDIUM

• US 20100043073A1
• Filed: 06/30/2009
• Published: 02/18/2010
• Est. Priority Date: 08/13/2008
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Kuwamura, Shin'ya
• Granted Patent: US 8,176,558 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

In one computer system, causing the second virtual machine, which executes antivirus software for detecting and removing the virus, to monitor at least one first virtual machine that is created on the computer and execute one or more application program, periodically storing a state of the first virtual machine as snapshot, suspending the first virtual machine from which the virus is detected if the antivirus software executed on the second virtual machine detects the virus, and restoring the first virtual machine at a state of a point in time when the snapshot is stored by using the snapshot of the suspended first virtual machine.

Claims

1. An antivirus method for taking measures against a virus invading a computer, comprising:

causing a second virtual machine, which executes antivirus software for detecting and removing the virus, to monitor at least one first virtual machine that is created on the computer and execute one or more application program;

periodically storing a state of the first virtual machine as snapshot;

suspending the first virtual machine from which the virus is detected if the antivirus software executed on the second virtual machine detects the virus; and

restoring the first virtual machine at a state of a point in time when the snapshot is stored by using the snapshot of the suspended first virtual machine.

2. The antivirus method according to claim 1, wherein

the suspending of the first virtual machine is made if the virus detected by the antivirus software cannot be removed.

3. The antivirus method according to claim 1, wherein

the first virtual machine restored by using the snapshot causing the second virtual machine to detect the virus by the antivirus software.

4. The antivirus method according to claim 3, wherein

the first virtual machine is again restored by using a snapshot that is stored preceding to the snapshot used to restore the first virtual machine, if the antivirus software detects the virus that cannot be removed from the restored first virtual machine.

5. An antivirus method for taking measures against a virus invading a computer, comprising:

causing antivirus software for detecting and removing the virus to operate under a program execution environment different from virtual machine, and to monitor at least one virtual machine that is created on the computer and execute one or more application program;

periodically storing a state of the virtual machine as snapshot;

suspending the virtual machine from which the virus is detected, if the antivirus software detects the virus; and

restoring the virtual machine at a state of a point in time when a snapshot is stored by using the snapshot of the suspended virtual machine.

6. A computer, comprising:

a creating unit capable of for creating at least one first virtual machine that execute one or more application program, and a second virtual machine that executes antivirus software for detecting and removing a virus; and

a monitor controlling unit capable of for operating the first virtual machine and the second virtual machine, and for causing the second virtual machine to monitor operation of the first virtual machine.

7. The computer according to claim 6, further comprising:

a storing unit capable of for periodically storing state of the first virtual machine as snapshot; and

a restoring unit capable of for suspending the first virtual machine from which the virus is detected, and for restoring a state of a point in time when a snapshot is stored by using the snapshot of the first virtual machine, if the antivirus software executed on the second virtual machine detects the virus that cannot be removed.

8. The computer according to claim 7, wherein

the monitor controlling unit causes the antivirus software of the second virtual machine to detect the virus for the first virtual machine restored by using the snapshot.

9. The computer according to claim 7, wherein

the monitor controlling unit causes the restoring unit to again restore the first virtual machine by using a snapshot stored preceding to the snapshot used to restore the first virtual machine, if the antivirus software executed on the second virtual machine detects the virus that cannot be removed from the first virtual machine.

10. A computer-readable recording medium on which is recorded a program for causing a computer, the program comprising:

a restoration control function to suspend a virtual machine, and to restore the virtual machine to a state of a point in time when a snapshot is stored by using the snapshot of the virtual machine, if a virus that cannot be removed is detected in the virtual machine created on the computer; and

a detection control function to cause the virus to be detected for the virtual machine restored by the restoration control function.

11. The recording medium according to claim 10, wherein

the detection control function causes the restoration control function to again restore the virtual machine by using a snapshot stored preceding to the snapshot used for restoration, if the virus that cannot be removed is detected from the restored virtual machine.