Anti-virus agent for use with databases and mail servers

• US 5,832,208 A
• Filed: 09/05/1996
• Issued: 11/03/1998
• Est. Priority Date: 09/05/1996
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Cheyenne Software International Sales Corporation
• Inventors: Luo, Chih-Ken, Chen, Chia-Hwang
• Primary Examiner(s): Hua, Ly
• Application Number:
  US08/709,025
• Time in Patent Office: 789 Days
• Field of Search: 395/186, 395/187.01, 395/183.15, 395/185.01, 395/183.04, 395/183.12, 395/183.14, 380/4, 380/3
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A software agent for detecting and removing computer viruses located in attachments to e-mail messages. A client-server computer network includes a server computer and a plurality of client computers. A message system, located at the server computer, controls the distribution of e-mail messages. An anti-virus module, located at the server computer, scans files for viruses. The agent is located at the server computer and provides an interface between the anti-virus module and the message system. The agent can operate both on a real-time basis and at preset period intervals. E-mail messages that are sent internally within the network can be scanned, e.g., Intranet e-mail messages. In addition, e-mail messages received over the Internet can be scanned.

Claims

1. For use in a computer network having a client-server architecture and a message system, a server-based method for detecting and removing computer viruses located in attachments to e-mail messages comprising the steps of:

providing a scan time period;

at the server, searching the message system to obtain a list of attachments to e-mail messages received at the message system within the previous scan time period;

at the server, passing each attachment in the list of attachments to an anti-virus detection module for computer virus scanning;

at the anti-virus detection module, detecting and removing computer viruses in each attachment in the list of attachments; and

at the server, re-attaching each attachment to the e-mail messages.

2. The method of claim 1 further comprising the step of repeating the method each scan time period.

3. The method of claim 1 wherein the e-mail messages comprises e-mail messages received from users at workstations on the client-server network on which the message system is located.

4. The method of claim 3 wherein the e-mail messages comprise e-mail messages received from external message systems.

5. The method of claim 1 wherein the e-mail messages comprise e-mail messages received over the Internet.

6. For use in a client-server computer network having a mail server, a method for detecting and removing computer viruses located in attachments to e-mail messages comprising the steps of:

A. setting a scan time period;

B. at the server, searching the mail server to obtain a list of attachments to e-mail messages input to the mail server within the previous scan time period;

C. at the server, detecting and removing computer viruses in each attachment in the list of attachments; and

D. at the server, re-attaching each attachment to the e-mail messages in the mail server.

7. The method of claim 6 further comprising the step of repeating steps B. through D. each scan time period.

8. The method of claim 6 wherein step C. further comprises the step of passing each attachment in the list of attachments to an anti-virus detection module for computer virus scanning.

9. For use in a client-server computer network having a mail server, a method for detecting and removing computer viruses located in attachments to e-mail messages comprising the steps of:

A. obtaining a scan time period;

B. searching the mail server to create a list of attachments to e-mail messages that were input to the mail server within the previous scan time period;

C. passing each attachment in the list of attachments to an anti-virus detection module for computer virus scanning and removal;

D. re-attaching each attachment to the e-mail messages in the mail server after scanning and removal of computer viruses at the anti-virus detection module; and

E. repeating steps B. through D. each scan time period.

10. For use in a client-server computer network having a plurality of workstations and a server, the server including a message system, a server-based method for detecting and removing computer viruses located in attachments to e-mail messages, comprising the steps of:

receiving an e-mail message at the message system;

upon receipt of the e-mail message, determining whether the e-mail message includes an attachment;

if the e-mail message includes an attachment, passing the attachment to an anti-virus detection module for computer virus scanning;

at the anti-virus detection module, detecting and removing computer viruses in the attachment; and

re-attaching each attachment to the e-mail messages.

11. The method of claim 10 wherein the step of receiving an e-mail message comprises the step of receiving an e-mail message from an external computer network.

12. The method of claim 10 wherein the step of receiving an e-mail message comprises the step of receiving an e-mail message from a workstation.

13. In a first computer network having a plurality of nodes, the first computer network configured to operate an e-mail system for sending and receiving among the plurality of nodes a plurality of e-mail messages, a sub-set of the plurality of e-mail messages having at least one attachment associated therewith, a method for detecting and removing computer viruses from the attachments to the plurality of e-mail messages, the method comprising the steps of:

detaching the at least one attachment from each of the sub-set of the plurality of e-mail messages;

sending the at least one attachment to an anti-virus application;

scanning the at least one attachment for the at least one computer virus in accordance with the anti-virus application;

removing the at least one computer virus from the at least one attachment; and

reattaching the at least one attachment to a corresponding one of the plurality of e-mail messages.

14. The method according to claim 13, wherein at least one of the plurality of e-mail messages originates from a second computer network in communication with the first computer network.

15. The method according to claim 13, wherein at least one of the plurality of e-mail messages originates from the first computer network.

16. The method according to claim 13, wherein the attachments are scanned regardless of whether opened or viewed by a user.

17. The method according to claim 13, wherein the attachments are scanned without user intervention.

18. The method according to claim 17, wherein at least one of the plurality of e-mail messages originates from a second computer network in communication with the first computer network.

19. In a first computer network having a plurality of nodes, the first computer network configured to operate an e-mail system for sending and receiving a plurality of e-mail messages among the plurality of nodes, a subset of the plurality of e-mail messages having at least one attachment associated therewith, a method for detecting and removing at least one computer virus from the at least one attachment, the method comprising the steps of:

detaching the at least one attachment from each of the plurality of e-mail messages;

determining whether the at least one attachment is infected with the at least one computer virus;

removing the at least one computer virus from the at least one attachment; and

reattaching the at least one attachment to a corresponding one of the plurality of e-mail messages.

20. A system for detecting computer viruses located in attachments to e-mail messages in a client-server computer network including a server computer and a plurality of client computers and a message system located at the server computer for controlling the distribution of e-mail messages, comprising:

an anti-virus module located at the server computer for scanning files for viruses; and

an agent located at the server computer, the agent providing an interface between the anti-virus module and the message system, and including

means for receiving a scan time period,

means for searching the message system to obtain a list of attachments to e-mail messages received at the message system within the previous scan time period,

means for passing each attachment in the list of attachments to the anti-virus module for computer virus scanning, and

means for re-attaching each attachment to the e-mail messages.

21. The system of claim 20 wherein the e-mail messages comprises e-mail messages received from client computers on the computer network.

22. The system of claim 20 wherein the message system comprises an external gateway and the e-mail messages comprise e-mail messages received from external message systems.

23. The system of claim 20 wherein the e-mail messages comprise e-mail messages received over an Internet connection.

24. An anti-virus agent for use in a client-server computer network having a server computer including a mail server with e-mail messages and a plurality of client computers, the anti-virus agent assisting in the detection of computer viruses located in attachments to e-mail messages, comprising:

means for setting a scan time period;

means, located at the server computer, for searching the mail server to obtain a list of attachments to e-mail messages input to the mail server within the previous scan time period;

means for passing each attachment in the list of attachments to an anti-virus detection module for computer virus scanning and removal; and

means, located at the server computer, for re-attaching each attachment to the e-mail messages in the mail server.

25. The system of claim 24 further comprising means for detecting and removing computer viruses in each attachment in the list of attachments.

26. In a first computer network having a plurality of nodes and configured to operate an e-mail system for sending and receiving among the plurality of nodes a plurality of e-mail messages, a sub-set of the plurality of e-mail messages having at least one attachment associated therewith, a system for detecting and removing computer viruses from the attachments to the plurality of e-mail messages, the system comprising:

means for detaching the at least one attachment from each of the sub-set of the plurality of e-mail messages;

means for sending the at least one attachment to an anti-virus application;

means for scanning the at least one attachment for the at least one computer virus in accordance with the anti-virus application;

means for removing the at least one computer virus from the at least one attachment; and

means for reattaching the at least one attachment to a corresponding one of the plurality of e-mail messages.

27. The system of claim 26, wherein at least one of the plurality of e-mail messages originates from a second computer network in communication with the first computer network.

28. The system of claim 26, wherein at least one of the plurality of e-mail messages originates from within the first computer network.

29. In a first computer network having a plurality of nodes and configured to operate an e-mail system for sending and receiving a plurality of e-mail messages among the plurality of nodes, a subset of the plurality of e-mail messages having at least one attachment associated therewith, a system for detecting and removing at least one computer virus from the at least one attachment, the system comprising:

means for detaching the at least one attachment from each of the plurality of e-mail messages;

means for determining whether the at least one attachment is infected with the at least one computer virus;

means for removing the at least one computer virus from the at least one attachment; and

means for reattaching the at least one attachment to a corresponding one of the plurality of e-mail messages.

30. A real-time system for detecting computer viruses located in attachments to e-mail messages in a client-server computer network including a server computer and a plurality of client computers, a message system being located at the server computer for controlling the distribution of e-mail messages and including a plurality of mailboxes, the real-time system comprising:

an anti-virus module located at the server computer for scanning files for viruses; and

an agent located at the server computer, the agent providing an interface between the anti-virus module and the message system and invoked whenever an e-mail message is forwarded to a mailbox, and including

means for determining if an e-mail message includes an attachment,

means for detaching the attachment from the e-mail message,

means for enabling the anti-virus module to scan the attachment for computer viruses, and

means for re-attaching each attachment to the e-mail messages.

31. The real-time system of claim 30 wherein the means for detaching further comprises means for storing the attachment in a file.

32. The real-time system of claim 31 wherein the means for enabling further comprises means for notifying the anti-virus module of the address of the file in which the attachment is stored.

33. The real-time system of claim 30 wherein the e-mail messages comprises e-mail messages received from client computers on the computer network.

34. The real-time system of claim 30 wherein the agent provides an interface between the message system and a plurality of different anti-virus modules.

35. The real-time system of claim 30 wherein the agent provides an interface between the anti-virus module and a plurality of different message systems.