Remote computer virus scanning

• US 7,020,895 B2
• Filed: 12/21/2000
• Issued: 03/28/2006
• Est. Priority Date: 12/24/1999
• Status: Active Grant

• Current Assignee: Withsecure Corporation
• Original Assignee: F-Secure Oyj
• Inventors: Albrecht, Mikael
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US09/741,084
• Publication Number:
  US 20010005889A1
• Time in Patent Office: 1,923 Days
• Field of Search: 713200-201, 713/188, 714/38, 709/200, 709221-224, 709/217, 726 22- 25
• US Class Current: 726/22
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of scanning electronic files for computer viruses comprises identifying at a first node 4 of a computer network 1, electronic files which require to be scanned for computer viruses. The first node 4 initiates a dialogue with a second node 7 of the network 1, the second node comprising a virus scanning application. During the dialogue, the second node 7 identifies to the first node 4 one or more portions of the electronic file required by the virus scanning application. The first node 4 transfers the identified portions to the second node 7 which then carries out a virus scanning operation. The result of this operation is then returned to the first node 4.

Claims

1. A method of scanning electronic files for computer viruses, the method comprising:

identifying at a first node of a computer network, electronic files which require to be scanned for computer viruses;

initiating a dialogue between said first node and a second node of the network, the second node comprising a virus scanning application, during which dialogue the second node identifies to the first node one or more portions of the electronic file required by the virus scanning application;

transferring the identified portion(s) from the first node to the second node over the network;

at the second node, scanning the transferred portions for computer viruses; and

if the second node determines that the electronic file includes a computer virus and determines that the electronic file is able to be disinfected, informing the first node by the second node of the determinations.

2. A method according to claim 1 and comprising identifying electronic files which require virus scanning, at a plurality of first nodes of the computer network and initiating a dialogue between the first nodes and the said second node when appropriate.

3. A method according to claim 1, wherein the first node and the second node are located at respective different locations in the computer network.

4. A method according to claim 1, wherein the first node is one of a database server, electronic mail server, an Internet server, a proxy server, or a firewall server.

5. A method according to claim 1, wherein the dialogue is carried out using a network protocol carried by IP.

6. A method according to claim 1 and comprising analysing the file portions received at the second node to determine whether or not the file contains the virus or cannot be guaranteed to not contain the virus, and returning the result to the first node over the network.

7. A method according to claim 6 and comprising transferring from the second node to the first node data portions to be written into the file to disinfect the file.

8. A method according to claim 6 and comprising sending instructions from the second node to the first node to inform the first node how to disinfect the file.

9. An anti-virus scanning system for use in scanning electronic files in a computer network, the system comprising:

a first computer having processing means arranged to identify electronic files which should be scanned for computer viruses; and

a second computer having processing means arranged to perform a virus scanning operation,

the first computer further comprising communication means for initiating a dialogue between the first computer and the second computer, during which the second computer identifies to the first computer those portions of the electronic files required by the first computer for performing the virus scanning operation, and for transferring those portions to the second computer, and

the second computer further comprising determination means for scanning the transferred portions for computer viruses, and, when the second computer determines that the electronic files include a computer virus and determines that the electronic files are able to be disinfected, informing the first computer of the determinations.

10. A computer memory encoded with executable instructions representing a computer program for causing a first computer connected to a computer network to:

identify an electronic file which is required to be scanned for computer viruses;

initiate a dialogue between the first computer and a second computer also connected to the computer network;

receive from the second computer an identification of portions of the electronic file which are required for virus scanning of the electronic file at the second computer;

transfer the identified portions from the first computer to the second computer;

scan the transferred portions for computer viruses at the second computer; and

if the second computer determines that the electronic file includes a computer virus and determines that the electronic file is able to be disinfected,

inform the first computer by the second computer of the determinations.

11. A computer memory encoded with executable instructions representing a computer program for causing a first computer connected to a computer network to:

receive a dialogue initiation request from a second computer also connected to the computer network concerning an electronic file identified by the second computer as requiring a virus scan;

identify to the second computer those portions of the electronic file which are required by the first mentioned computer for performing a virus scanning operation at the first computer;

receive the identified portions of the electronic file from the second computer; and

inform the second computer of an outcome if the first computer determines that the electronic file includes a computer virus and determines that the electronic file is able to be disinfected.

12. A method of disinfecting an electronic file stored at a first node of a computer network, after the file has been identified as containing a virus by a virus scanning engine located at a second network node, wherein the first node and the second node initiate a dialogue, the method comprising:

informing the first node by the second node that a virus has been identified and is able to be disinfected;

sending from the second node to the first node, data portions to be written into the infected file or instructions for disinfecting the file; and

receiving the data portions or instructions at the first node and writing the data portions into the infected file or carrying out said instructions.

13. A method according to claim 12, wherein said first and second nodes are respective computer workstations coupled to a common network.

14. A method according to claim 13, wherein the workstation corresponding to the second node is arranged to communicate with a plurality of workstations corresponding to respective first nodes.