Computer virus screening

• US 6,577,920 B1
• Filed: 10/02/1998
• Issued: 06/10/2003
• Est. Priority Date: 10/02/1998
• Status: Expired due to Term

• Current Assignee: F-Secure Oyj
• Original Assignee: Data Fellows Oyj
• Inventors: Hyppönen, Mikko, Hyppönen, Ari, Siilasmaa, Risto, Kuisha, Mikko, Rahu, Urmas
• Primary Examiner(s): Hayes, Gail
• Assistant Examiner(s): TRUVAN, LEYNNA THANH
• Application Number:
  US09/165,279
• Time in Patent Office: 1,712 Days
• Field of Search: 713/201, 713/164, 713/188, 713/200, 713/176
• US Class Current: 700/200
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A method of screening a software file for viral infection comprising defining a first database of known macro virus signatures, a second database of known and certified commercial macro signatures, and a third database of known and certified local macro signatures. The file is scanned to determine whether or not the file contains a macro. If the file contains a macro, a signature for the macro is determined and screened against the signatures contained in said databases. A user is alerted in the event that the macro has a signature corresponding to a signature contained in said first database and/or in the event that the macro has a signature which does not correspond to a signature contained in either of the second and third databases.

Claims

1. A method of screening a software file for viral infection, the method comprising:

defining a first database of known macro virus signatures, a second database of known and certified commercial macro signatures, and a third database of known and certified local macro signatures;

scanning said file to determine whether or not the file contains a macro; and

, if the file contains a macro

determining a signature for the macro and screening that signature against the signatures contained in said databases; and

alerting a user in the event that the macro has a signature corresponding to a signature contained in said first database and/or in the event that the macro has a signature which does not correspond to a signature contained in either of the second and third databases.

2. A method according to claim 1, wherein said step of defining a second database of known and certifiable commercial macro signatures comprises scanning a set of end user applications which are known to be virus free to identify macros therein, determining a signature for each of the identified macros, and compiling the determined signatures into the second database.

3. A method according to claim 1, wherein the step of defining the third database comprises the further steps of updating the third database with additional macro signatures.

4. A method according to claim 3, wherein said updating steps are done via an electronic link between a computer hosting the database, where the scanning of the file is performed, and a remote central computer.

5. A method according to claim 1, wherein thee user is a network manager and database updates made by the network manager are communicated to network end user computers where virus screening is performed.

6. A method according to claim 1, wherein said step of determining a signature for the macro and screening that signature comprises deriving a signature of the macro and comparing the derived signature with signatures in the databases.

7. A method of screening a software file to determine whether any macro contained therein does or does not contain a virus, the method comprising:

defining a first database of known macro virus signatures, a second database of known and certified commercial macro signatures, and a third database of known and certified local macro signatures;

scanning said file to determine whether or not the file contains a macro; and

if the file contains a macro, determining whether or not the macro has a signature corresponding to one of the signatures contained in said databases.

8. Apparatus for screening a software file for viral infection, the apparatus comprising:

a memory storing a first database of known macro virus signatures, a second database of known and certified commercial macro signatures, and a third database of known and certified local macro signatures; and

a data processor arranged to scan said file to determine whether or not the file contains a macro and, if the file does contain a macro, to determine whether or not the macro has a signature corresponding to one of the signatures contained in said databases.

9. The apparatus according to claim 8, wherein, in order to determine whether or not the macro has a signature corresponding to one of the signatures contained in said databases, said data processor is arranged to derive a signature of the macro and to compare the derived signature with signatures in the databases.

10. A computer memory encoded with executable instructions representing a computer program for causing computer system to:

maintain a first database of known macro virus signatures, a second database of known and certified commercial macro signatures, and a third database of known and certified local macro signatures;

scan data files to determine whether or not the files contains a macro; and

if a file contains a macro, determine whether or not the macro has a signature corresponding to one of the signatures contained in said second database.

11. A computer memory according to claim 10, wherein the computer program provides for the updating of said third database with additional macro signatures.

12. A computer memory according to claim 10, wherein the computer program causes the files to be scanned to determine whether or not they contain a signature corresponding to one of signatures contained in the first database.

13. A computer memory according to claim 12, wherein the computer program causes the third database to be scanned for a match between signatures of a file macro not already matched in the first and second databases, and signatures contained in the third database.

14. The computer memory according to claim 10, wherein in order to determine whether or not the macro has a signature corresponding to one of the signatures contained in said databases, said computer program causes the computer system to derive a signature of the macro and to compare the derived signature with signatures in the databases.