User alerts in an anti computer virus system

• US 7,272,724 B2
• Filed: 02/20/2001
• Issued: 09/18/2007
• Est. Priority Date: 02/20/2001
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Tarbotton, Lee Codel Lawson, Wolff, Daniel Joseph, Moore, Robert Edward
• Primary Examiner(s): Sheikh; Ayaz
• Assistant Examiner(s): Chai; Longbit
• Application Number:
  US09/785,216
• Publication Number:
  US 20020116542A1
• Time in Patent Office: 2,401 Days
• Field of Search: 714/38, 714/45, 713/200, 713/188
• US Class Current: 713/188
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

An anti computer virus program uses a library of virus drivers that includes an indication of whether a particular virus can cause irreparable damage and data indicating enhanced user warnings and actions that might be associated with such viruses. If a detected computer virus is one that can cause irreparable damage, then an enhanced user warning (16) is issued indicating this to the user and a notification (28) of the possibility of such corruption is added into the repaired computer file. The notification may take the form of an electronically signed (30) banner message or the like.

Claims

1. A computer program product stored in a computer readable storage medium comprising a computer program operable to control a computer to apply a plurality of anti computer virus tests to a target computer file, said computer program comprising:

(i) virus scanning logic for detecting if a target computer file is infected with a computer virus by applying a plurality of anti computer virus tests to said target computer file;

(ii) virus cleaning and file repair logic for cleaning said target computer file by removing a detected computer virus from said target computer file and for repairing any changes caused by said detected computer virus to said target computer file by reversing said changes;

(iii) virus identifying logic for detecting whether or not said detected computer virus is of a type that can cause changes to said target computer file that cannot be reversed by said virus cleaning and file repair logic; and

(iv) warning generating logic, responsive to said virus identifying logic detecting that said detected computer virus is of a type that can cause changes to said target computer file that cannot be reversed by said virus cleaning and file repair logic, for generating a warning to a user that said target computer file may have suffered irreparable damage;

wherein said virus scanning logic is responsive to a library of tests to detect different computer viruses, said library including data specifying which computer viruses can cause changes that cannot be reversed by said virus cleaning and repair logic;

wherein said warning generating logic can generate a plurality of different types of warnings to said user that said target computer file may have suffered irreparable damage and said library includes data specifying which of said plurality of types of warnings should be issued in response to a particular detected computer virus;

wherein said warning to said user that said target computer file may have suffered irreparable damage is associated with a notification message that includes authentication data identifying said target computer file into which said notification message was inserted.

2. A computer program as claimed in claim 1, wherein said warning to said user that said target computer file may have suffered irreparable damage includes an option to add said notification message into said target computer file.

3. A computer program as claimed in claim 2, wherein said notification message includes an electronic signature applied by said warning generating logic.

4. A computer program product as claimed in claim 1, wherein upon detection of a target computer file infected with a computer virus that may have caused irreparable damage, said virus cleaning and repair logic presents said user with different options for further processing of said target file than if said target computer file were infected with a computer virus that only causes reversible changes.

5. A method of applying a plurality of anti computer virus tests to a target computer file, said method comprising the steps of:

(i) virus scanning to detect if a target computer file is infected with a computer virus by applying a plurality of anti computer virus tests to said target computer file;

(ii) virus cleaning and file repairing to clean said target computer file by removing a detected computer virus from said target computer file and to repair any changes caused by said detected computer virus to said target computer file by reversing said changes;

(iii) virus identifying to detect whether or not said detected computer virus is of a type that can cause changes to said target computer file that cannot be reversed by said virus cleaning and file repair logic; and

(iv) if said detected computer virus is of a type that can be removed from said target computer file but can cause changes to said target computer file that cannot be reversed by said virus cleaning and file repair logic, generating a warning to a user that said target computer file may have suffered irreparable damage;

wherein said virus scanning uses a library of tests to detect different computer viruses, said library including data specifying which computer viruses can cause changes that cannot be reversed by said virus cleaning and repair logic;

wherein said warning generation can generate a plurality of different types of warnings to said user that said target computer file may have suffered irreparable damage and said library includes data specifying which of said plurality of types of warnings should be issued in response to a particular detected computer virus;

wherein said warning to said user that said target computer file may have suffered irreparable damage includes a notification message that includes authentication data identifying said target computer file into which said notification message was inserted.

6. A method as claimed in claim 5, wherein said warning to said user that said target computer file may have suffered irreparable damage includes adding said notification message into said target computer file.

7. A method as claimed in claim 6, wherein said notification message includes an electronic signature applied by said warning generating logic.

8. A method as claimed in claim 5, wherein upon detection of a target computer file infected with a computer virus that may have caused irreparable damage, said user is presented with different options for further processing of said target file than if said target computer file were infected with a computer virus that only causes reversible changes.

9. Apparatus for applying a plurality of anti computer virus tests to a target computer file, said apparatus comprising:

(i) a virus scanner for detecting if a target computer file is infected with a computer virus by applying a plurality of anti computer virus tests to said target computer file;

(ii) a virus cleaner and file repairer for cleaning said target computer file by removing a detected computer virus from said target computer file and for repairing changes caused by said detected computer virus to said target computer file by reversing said changes;

(iii) a virus identifier for detecting whether or not said detected computer virus is of a type that can cause changes to said target computer file that cannot be reversed by said virus cleaning and file repair logic; and

(iv) a warning generator, responsive to said virus identifier detecting that said detected computer virus is of a type that can be removed from said target computer file but can cause changes to said target computer file that cannot be reversed by said virus cleaning and file repair logic, for generating a warning to a user that said target computer file may have suffered irreparable damage;

wherein said virus scanner is responsive to a library of tests to detect different computer viruses, said library including data specifying which computer viruses can cause changes that cannot be reversed by said virus cleaning and repair logic;

wherein said warning generator can generate a plurality of different types of warnings to said user that said target computer file may have suffered irreparable damage and said library includes data specifying which of said plurality of types of warnings should be issued in response to a particular detected computer virus;

wherein said warning to said user that said target computer file may have suffered irreparable damage is associated with a notification message that includes authentication data identifying said target computer file into which said notification message was inserted.

10. Apparatus as claimed in claim 9, wherein said warning to said user that said target computer file may have suffered irreparable damage includes adding said notification message into said target computer file.

11. Apparatus as claimed in claim 10, wherein said notification message includes an electronic signature applied by said warning generating logic.

12. Apparatus as claimed in claim 9, wherein upon detection of a target computer file infected with a computer virus that may have caused irreparable damage, said virus cleaner and repairer presents said user with different options for further processing of said target file than if said target computer file were infected with a computer virus that only causes reversible changes.