SYSTEM, METHOD, AND COMPUTER PROGRAM PRODUCT FOR REACTING IN RESPONSE TO A DETECTION OF AN ATTEMPT TO STORE A CONFIGURATION FILE AND AN EXECUTABLE FILE ON A REMOVABLE DEVICE

• US 20130247189A1
• Filed: 06/27/2008
• Published: 09/19/2013
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Kumar, Lokesh, Ramachetty, Harinath V.
• Granted Patent: US 8,918,872 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/08 Access security

Abstract

A system, method, and computer program product are provided for reacting in response to a detection of an attempt to store a configuration file and an executable file on a removable device. In use, a first device removably coupled to a second device is identified. Additionally, an attempt to store on the first device a configuration file for the first device and an executable file is detected. Further, a reaction is performed in response to the detection of the attempt.

Claims

1. A computer program product embodied on a non-transitory tangible computer readable medium for performing operations, comprising:

identifying a first device coupled to a second device, wherein the first device couples to the second device using a wireless protocol connection over a universal serial bus (USB) port;

monitoring file copy operations directed toward the wireless protocol connection associated with the first device, and wherein the file copy operations are associated with copying existing malware files, which are in the second device, to the first device;

detecting an attempt to store on the first device a configuration file for the first device and an executable file, which is a particular malware file that is not previously detected by an antivirus program provided in the second device, wherein the second device is a personal computer that includes a security system, which includes antivirus software, and wherein the security system is configured to scan a plurality of ports, including the USB port, of the personal computer in order to identify the attempt; and

reacting in response to the detection of the attempt by;

providing a user of the second device with an option through a graphical display of the personal computer to;

review the configuration file using the graphical display;

open the configuration file using the graphical display; and

prevent storage of the configuration file for the first device and the executable file on the first device by deleting the configuration file.

2. The computer program product of claim 1, wherein the first device is a flash-based memory device.

3. The computer program product of claim 1, wherein the second device includes a removable storage device.

5. The computer program product of claim 1, wherein the configuration file for the first device instructs an operating system to run the executable file.

7. The computer program product of claim 1, wherein the attempt is performed by a program residing on the second device.

8. The computer program product of claim 7, wherein the program is malicious.

11. The computer program product of claim 1, wherein the reacting includes providing a user of the second device with an option to allow storage of the configuration file for the first device and the executable file on the first device.

14. The computer program product of claim 1, wherein the reacting includes providing a user of the second device with an option to review the configuration file and/or the executable file.

15. The computer program product of claim 1, further comprising computer code for monitoring file copy and file create operations directed to the first device.

4. (canceled)

6. (canceled)

9. (canceled)

10. (canceled)

12. (canceled)

13. (canceled)

16. (canceled)

17. (canceled)

18. A method, comprising:

identifying a first device coupled to a second device, wherein the first device couples to the second device using a wireless protocol connection over a universal serial bus (USB) port;

monitoring file copy operations directed toward the wireless protocol connection associated with the first device, and wherein the file copy operations are associated with copying existing malware files, which are in the second device, to the first device;

detecting an attempt to store on the first device a configuration file for the first device and an executable file, which is a particular malware file that is not previously detected by an antivirus program provided in the second device, wherein the second device is a personal computer that includes a security system, which includes antivirus software, and wherein the security system is configured to scan a plurality of ports, including the USB port, of the personal computer in order to identify the attempt; and

reacting in response to the detection of the attempt by;

providing a user of the second device with an option through a graphical display of the personal computer to;

review the configuration file using the graphical display;

open the configuration file using the graphical display; and

prevent storage of the configuration file for the first device and the executable file on the first device by deleting the configuration file.

19. A system, comprising:

a processor configured for;

identifying a first device coupled to a second device, wherein the first device couples to the second device using a wireless protocol connection over a universal serial bus (USB) port;

monitoring file copy operations directed toward the wireless protocol connection associated with the first device, and wherein the file copy operations are associated with copying existing malware files, which are in the second device, to the first device;

detecting an attempt to store on the first device a configuration file for the first device and an executable file, which is a particular malware file that is not previously detected by an antivirus program provided in the second device, wherein the second device is a personal computer that includes a security system, which includes antivirus software, and wherein the security system is configured to scan a plurality of ports, including the USB port, of the personal computer in order to identify the attempt; and

reacting in response to the detection of the attempt by;

providing a user of the second device with an option through a graphical display to;

review the configuration file using the graphical display;

open the configuration file using the graphical display; and

prevent storage of the configuration file for the first device and the executable file on the first device by deleting the configuration file.

20. The system of claim 19, wherein the processor is coupled to memory via a bus.