Web server apparatus and method for virus checking

• US 6,785,732 B1
• Filed: 09/11/2000
• Issued: 08/31/2004
• Est. Priority Date: 09/11/2000
• Status: Expired due to Term

• Current Assignee: Finjan Blue, Inc. (SoftBank Group Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Bates, Cary Lee, Day, Paul Reuben, Santosuosso, John Matthew
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US09/605,258
• Time in Patent Office: 1,450 Days
• Field of Search: 709/225, 709/226, 709/227, 709/232, 709/238, 713/201, 713/188, 713/189
• US Class Current: 709/232
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A web server computer system includes a virus checker and mechanisms for checking e-mails and their attachments, downloaded files, and web sites for possible viruses. When an e-mail message contains a detected virus, the message is discarded, and both the sender and recipient are informed via e-mail that the message contained a virus. When an e-mail attachment contains a detected virus, the attachment is deleted, and the e-mail message without the attachment is sent to the web client, along with a message explaining that the e-mail message had an attachment that was automatically deleted because it had a virus. When a downloaded file contains a virus, the downloaded file is deleted, and an error message is sent to the web client to inform the web client that the requested file had a virus. When a requested web site (i.e., Uniform Resource Locator (or URL)) has been labeled as a source for a known virus, a message is sent to the web client stating that a virus may have been downloaded from that URL. In addition, if the requested URL has not been labeled as a source for a known virus, but it contains links that have been so labeled, the web page is processed before being sent to the user to identify those potentially dangerous links. In this manner a web server can perform virus checking of different types of information real-time as the information is requested by a web client. In addition, a web client may also request that the server perform virus checking on a particular drive on the web client. If this case, the web server may receive information from the web client drive, scan the information for viruses, and inform the web client whether any viruses were found. In the alternative, the web server may download a client virus checker to the web client and cause the client virus checker to be run on the web client. The preferred embodiments thus allow a virus checker on a web server to dynamically scan incoming data, and to scan web clients coupled to the web server, thereby eliminating the need for virus checking software to be installed on each web client.

Claims

1. A web server computer apparatus comprising:

(A) a processor;

(B) a memory coupled to the processor;

(C) a network interface coupled to the processor and coupled via a network to a plurality of web clients;

(D) a plurality of web pages residing in the memory;

(E) a user list residing in the memory, the user list including user virus checking preferences for at least one user in the user list;

(F) a web server application residing in the memory and executed by the processor, the web server application having a plurality of addresses corresponding to the plurality of web pages, the web server application servicing requests for the plurality of web pages, the web server application including;

(F1) a web page virus processing mechanism residing in the memory and executed by the processor, the web page virus processing mechanism determining whether an address requested by a web client has been used previously to access a virus before delivering information at the requested address to the web client;

(F2) a file virus processing mechanism residing in the memory and executed by the processor, the file virus processing mechanism determining whether a file requested by a web client contains a virus before delivering the requested file to the web client;

(G) an e-mail server application residing in the memory and executed by the processor, the e-mail server application having a plurality of e-mail addresses for which it has responsibility, the e-mail server application processing incoming e-mail messages to the plurality of e-mail addresses and processing outgoing e-mail messages from the plurality of e-mail addresses, the e-mail server application including;

(G1) an e-mail virus processing mechanism residing in the memory and executed by the processor, the e-mail virus processing mechanism determining whether an e-mail message and any attachments to the e-mail message contain a virus before passing the e-mail message to a specified web client;

(H) a virus information database coupled to the processor that stores information regarding at least one virus that is used by the web page virus processing mechanism, the file virus processing mechanism, and the e-mail virus processing mechanism;

(I) a mechanism that notifies at least one authority when a virus is detected; and

(J) a mechanism that downloads a client version of a virus checker application to a web client and causes the client version of the virus checker application to be executed on the web client to check for viruses on the web client.

2. The apparatus of claim 1 wherein the information regarding the at least one virus includes an address from which a virus has been accessed, and an e-mail address of a sender that sent a virus.

3. The apparatus of claim 1 further comprising a user feedback mechanism residing in the memory and executed by the processor, the user feedback mechanism allowing a user to input information regarding a virus to the web server application and to the e-mail server application.