Method and system for bi-directional updating of antivirus database

• US 7,080,000 B1
• Filed: 07/23/2001
• Issued: 07/18/2006
• Est. Priority Date: 03/30/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Cambridge, Rodney D.
• Primary Examiner(s): FERRIS III, FRED O
• Application Number:
  US09/911,414
• Time in Patent Office: 1,821 Days
• Field of Search: 703/22, 703/21, 714/38, 707/200, 707/203, 713/38, 713/188, 726 22- 33
• US Class Current: 703/21
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A method for maintaining updated antivirus files within a computer network comprising at least one user computer and at least one central service computer. Each of the user computer and central service computer has an antivirus database and the network is connected to an antivirus server. The method includes receiving a new antivirus file at one of the user computer and the central service computer and updating the computer'"'"'s antivirus database. The antivirus databases of the central service computer and the user computer are compared to determine if one of the databases contain new antivirus files not contained within the other database. The central service computer and the user computer are each configured to send the new antivirus files to the other of the central service computer and the user computer to update the antivirus database.

Claims

1. A method for maintaining updated antivirus files within a computer network comprising at least one user computer and at least one central service computer, the user computer and the central service computer each having an antivirus database, the network being connected to an antivirus server, the method comprising:

receiving a new antivirus file at one of the user computer and the central service computer and updating the computer'"'"'s antivirus database;

comparing the antivirus databases of the central service computer and the user computer if the new antivirus file was received at the central service computer from the antivirus server or if the new antivirus file was received at the user computer from the antivirus server, in order to determine if one of the databases contain a new antivirus file not contained within the other database; and

notifying the central service computer of the new antivirus data file located on the user computer, and the user computer inquiring whether to update the antivirus database with the new antivirus files;

whereby the central service computer and the user computer are each configured to send the new antivirus file to the other of the central service computer and the user computer to update the antivirus database such that the antivirus database of the central service computer is capable of being updated by the user computer and the antivirus database of the user computer is capable of being updated by the central service computer;

wherein after the central service computer is notified of the new antivirus data file located on the user computer, the user computer waits for a request from the central service computer to send the new antivirus data file;

wherein the central service computer is configured to send the new antivirus file to the user computer to update the virus database of the user computer, if is determined that the central service computer contains the new antivirus file not contained within the user computer;

wherein the user computer is configured to send the new antivirus file to the central service computer to update the virus database of the central service computer, if is determined that the user computer contains the new antivirus file not contained within the central service computer and if it is determined that the user computer is authorized to send new antivirus files to the central service computer to update the virus database of the central service computer;

wherein the central service computer is configured to periodically obtain updated antivirus files from the antivirus server.

2. The method of claim 1 wherein the computer network comprises a plurality of user computers communicatively coupled with the central service computer and antivirus server.

3. The method of claim 2 wherein the central service computer is configured to periodically send updated antivirus files to the user computers.

4. The method of claim 1 wherein the antivirus server and the central service computer are both connected to the Internet.

5. The method of claim 4 wherein the antivirus server hosts a web site on the Internet.

6. The method of claim 1 wherein the new antivirus file contains at least one new virus definition.

7. The method of claim 1 wherein the new antivirus file contains an updated version of an antivirus signature file.

8. The method of claim 7 wherein comparing the antivirus databases comprises finding the antivirus file with the latest version number.

9. The method of claim 7 wherein comparing the antivirus database comprises finding the antivirus file with the latest updated date.

10. The method of claim 1 further comprising using the new antivirus file to scan files located on the user computer and identify infected data on the computer.

11. The method of claim 10 further comprising cleaning the identified infected data on the computer using the new antivirus file.

12. The method of claim 1 further comprising notifying one of the central service computer and the user computer of the new antivirus files contained within the other of the central service computer and the user computer.

13. The method of claim 1 further comprising identifying the new antivirus file on the user computer not contained within the antivirus database of the central service computer.

14. The method of claim 13 further comprising automatically sending the new antivirus file to the central service computer.

15. The method of claim 1 wherein receiving a new antivirus file comprises receiving a new antivirus file at the user computer.

28. The method of claim 1, wherein the antivirus databases are compared after the new antivirus file is sent to the user computer if the new antivirus file was not sent from the central service computer.

29. The method of claim 28, wherein the databases are compared if the new antivirus file was sent from a server other than the central service computer over the Internet.

30. The method of claim 1, wherein the central service computer is at least one of a network server and a resource.

31. The method of claim 1, wherein the user computer is at least one of a local computer and a client computer.

32. The method of claim 1 wherein after the user computer sends the new antivirus file to the central service computer to update the virus database of the central service computer, the central service computer sends the new antivirus file to other user computers located on the computer network to update the virus databases of the other user computers.

33. The method of claim 1 wherein the new antivirus file includes a set of fields comprising a date updated field referring to a last date the antivirus file was modified, a time field referring to a last time the antivirus file was modified, and a DAT version field referring to a latest version of a main antivirus data file that was used to scan a file for computer viruses.

16. A system for maintaining updated antivirus files within a computer network comprising at least one user computer and at least one central service computer, the network being connected to an antivirus server configured for providing new antivirus files to the central service computer and the user computer, the system comprising:

an antivirus database located on each of the user computer and the central service computer;

an antivirus database comparison application located on the user computer and configured to compare the antivirus databases of the central service computer and the user computer if a new antivirus file was received at the central service computer from the antivirus server or if a new antivirus file was received at the user computer from the antivirus server, in order to determine if one of the databases contain a new antivirus file not contained within the other database;

the antivirus database comparison application notifying the central service computer of the new antivirus data file located on the user computer, and the user computer inquiring whether to update the antivirus database with the new antivirus files; and

memory for at least temporarily storing said antivirus database;

whereby the central service computer and the user computer are each configured to send the new antivirus files to the other of the central service computer and the user computer such that the antivirus database of the central service computer is capable of being updated by the user computer and the antivirus database of the user computer is capable of being updated by the central service computer;

wherein after the central service computer is notified of the new antivirus data file located on the user computer, the user computer waits for a request from the central service computer to send the new antivirus data file;

wherein the central service computer is configured to send the new antivirus file to the user computer to update the virus database of the user computer, if is determined that the central service computer contains the new antivirus file not contained within the user computer;

wherein the user computer is configured to send the new antivirus file to the central service computer to update the virus database of the central service computer, if is determined that the user computer contains the new antivirus file not contained within the central service computer and if it is determined that the user computer is authorized to send new antivirus files to the central service computer to update the virus database of the central service computer;

wherein the central service computer is configured to periodically obtain updated antivirus files from the antivirus server.

17. The system of claim 16 wherein the computer network comprises a plurality of user computers in communication with the central service computer.

18. The system of claim 17 wherein the central service computer is configured to periodically send updated antivirus files to the user computers.

19. The system of claim 16 wherein the new antivirus file contains at least one new virus definition.

20. The system of claim 16 wherein the new antivirus file contains an updated version of virus definitions.

21. The system of claim 16 wherein the user computer further comprises an antivirus program operable to identify infected files located on the user computer and clean the infected files.

22. A computer product for maintaining updated antivirus files within a computer network comprising at least one user computer and at least one central service computer, each of the user computer and the central service computer having an antivirus database, the network being connected to an antivirus server, the product comprising:

computer code that receives a new antivirus file at the user computer and updates the user computer'"'"'s antivirus database;

computer code that compares the antivirus databases of the central service computer and the user computer if the new antivirus file was received at the central service computer from the antivirus server or if the new antivirus file was received at the user computer from the antivirus server, in order to determine if one of the databases contain a new antivirus file not contained within the other database, the central service computer and the user computer each being configured to send the new antivirus file to the other of the central service computer and the user computer such that the antivirus database of the central service computer is capable of being undated by the user computer and the antivirus database of the user computer is capable of being updated by the central service computer;

computer code that notifies the central service computer of the new antivirus data file located on the user computer, and for the user computer to inquire whether to update the antivirus database with the new antivirus files; and

a computer readable medium that stores said computer codes;

wherein after the central service computer is notified of the new antivirus data file located on the user computer, the user computer waits for a request from the central service computer to send the new antivirus data file;

wherein the central service computer is configured to send the new antivirus file to the user computer to update the virus database of the user computer, if is determined that the central service computer contains the new antivirus file not contained within the user computer;

wherein the user computer is configured to send the new antivirus file to the central service computer to update the virus database of the central service computer, if is determined that the user computer contains the new antivirus file not contained within the central service computer and if it is determined that the user computer is authorized to send new antivirus files to the central service computer to update the virus database of the central service computer;

wherein the central service computer is configured to periodically obtain updated antivirus files from the antivirus server.

23. The computer product of claim 22 wherein the computer readable medium is selected from the group consisting of CD-ROM, floppy disk, tape, flash memory, system memory, and hard drive.

24. The computer product of claim 22 further comprising code that scans files located on the user computer to identify infected data.

25. The computer product of claim 22 further comprising code that cleans the infected data.

26. The computer product of claim 22 further comprising code that notifies the user computer of the new antivirus files contained within the central service computer.

27. The computer product of claim 22 further comprising code that automatically sends the new antivirus file to the central service computer if it is not located with the antivirus database of the central service computer.