Obtaining user responses in a virtual execution environment

• US 6,594,686 B1
• Filed: 03/02/2000
• Issued: 07/15/2003
• Est. Priority Date: 03/02/2000
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Network Associates Technology, Inc.
• Inventors: Edwards, Jonathan, White, Edmund
• Primary Examiner(s): Dinh, Dung C.
• Assistant Examiner(s): JOHNSON, MARLON B
• Application Number:
  US09/517,133
• Time in Patent Office: 1,230 Days
• Field of Search: 709/203, 709/217, 709/218, 709/219, 709/223, 709/224, 709/225, 709/229, 713/201, 714/38, 714/39, 714/48, 714/49
• US Class Current: 709/203
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The invention provides for on-access scanning of archives, such as “ZIP” files, for files containing viruses or other unwanted characteristics. In particular, disclosed are various techniques for beginning a scanning operation, and then monitoring the scanning operation to determine whether it is completing in a reasonable time. If the scanning operation is taking place within a terminal server type of environment, such as the Microsoft Terminal Server, where an application program is run in a virtual execution environment, then provision is made to identify client connections to the server so that error messages (such as denying file access due to a virus) can be presented to a terminal server client'"'"'s terminal, rather than at the terminal server console.

Claims

1. A method for unshared applications executing within a terminal server environment to interact with clients of a terminal server, wherein an application shared within the terminal server environment is executed as multiple instances on the terminal server instead of on the clients and the terminal server routes input/output for each instance to the client associated with the instance, the method comprising:

executing a second application on the terminal server to interact with a first application shared within the terminal server environment, said second application being unshared and without routing by the terminal server of input/output for the second application to the clients of the terminal server;

determining, by the second application, a session identifier for a client sharing the first application within the terminal server environment; and

using the session identifier to send a message to the client instead of to the terminal server.

2. The method of claim 1, wherein the first application is unaware it is being shared.

3. The method of claim 1, further comprising:

using the session identifier to establishing an input/output communication channel with the client.

4. The method of claim 3, further comprising:

receiving over said communication channel a response to the message.

5. The method of claim 3, further comprising:

monitoring, by the second application, of accessing of resources by the first application; and

determining, by the second application, an error condition arising from accessing a particular resource by the first application;

wherein the message concerns the error condition and the message is sent to the client over said communication channel.

6. The method of claim 5, wherein the second application is a virus scanner, and wherein the error condition is a virus detected in the particular resource.

7. The method of claim 1, further comprising:

monitoring, by the second application, of accessing of resources by the first application; and

determining, by the second application, an error condition arising from accessing a particular resource by the first application;

wherein the message concerns the error condition.

8. The method of claim 7, wherein the second application is a virus scanner, and wherein the error condition is a virus detected in the particular resource.

9. The method of claim 7, further comprising:

starting an elapsed-time counter; and

starting scanning the particular resource for viruses;

wherein said determining the error condition comprises identifying the elapsed-time counter has exceeded a scanning time-limit.

10. The method of claim 7, further comprising:

starting scanning the particular resource for viruses; and

determining if the particular resource corresponds to an archive file, and if so, starting an elapsed-time counter before scanning the archive file for viruses;

wherein said determining the error condition includes determining if the elapsed-time counter exceeded a scanning time-limit.

12. The medium of claim 1, said instructions comprising further instructions to direct the processor to:

use the session identifier to establish an input/output communication channel with the client.

13. The medium of claim 12, said instructions comprising further instructions to direct the processor to:

receive, over said communication channel, a response to the message.

14. The medium of claim 12, said instructions comprising further instructions to direct the processor to:

monitor, by the second application, accessing of resources by the first application;

determine, by the second application, an error condition arising from accessing a particular resource by the first application;

configure the message to include the error condition; and

send the message over said communication channel.

15. The medium of claim 14, wherein the second application is a virus scanner, and wherein the error condition is a virus detected in the particular resource.

11. A readable medium having encoded thereon instructions for allowing unshared applications executing within a terminal server environment to interact with clients of a terminal server, wherein an application shared within the terminal server environment is executed as multiple instances on the terminal server instead of on the clients and the terminal server routes input/output for each instance to the client associated with the instance, said instructions when executed capable of directing a processor to:

execute a second application on the terminal server to interact with a first application shared within the terminal server environment, said second application being unshared and without routing by the terminal server of input/output for the second application to the clients of the terminal server;

determine, by the second application, a session identifier for client sharing the first application; and

use the session identifier to send a message to the client instead of to the terminal server.

16. The medium of claim 11, said instructions comprising further instructions to direct the processor to:

monitor, by the second application, of accessing of resources by the first application; and

configure the message to include the error condition; and

send the message over said communication channel.

17. The medium of claim 16, wherein the second application is a virus scanner, and wherein the error condition is a virus detected in the particular resource.

18. The medium of claim 16, said instructions comprising further instructions to direct the processor to:

start an elapsed-time counter; and

start scanning the particular resource for viruses;

wherein said instructions for determining the error condition further comprise instructions for determining that the elapsed-time counter has exceeded a scanning time-limit.

19. The medium of claim 16, said instructions comprising further instructions to direct the processor to:

start scanning the particular resource for viruses; and

determine if the particular resource corresponds to an archive file, and if so, starting an elapsed-time counter before scanning the archive file for viruses;

wherein said instructions for determining the error condition further comprise instructions for determining that the elapsed-time counter has exceeded a scanning time-limit.

20. A system for unshared applications executing within a terminal server environment to interact with clients of a terminal server, wherein an application shared within the terminal server environment is executed as multiple instances on the terminal server instead of on the clients and the terminal server routes input/output for each instance to the client associated with the instance, the system comprising:

a file access monitor for monitoring file accesses by a first application shared within the terminal server environment;

a virus scanning arrangement executing on the server for scanning accessed files for viruses;

a timer arrangement for timing said scanning accessed files for viruses;

a scan-termination arrangement for interrupting the virus scanning arrangement if said scanning accessed files for viruses does not complete within a timeout period;

means for determining, by the virus scanning arrangement, a session identifier for a client sharing the first application; and

means for sending a message, to the client according to the session identifier instead of to the terminal server, indicating said scanning accessed files for viruses timed out.