Remote e-mail scanning system and method

• US 7,299,361 B1
• Filed: 01/12/2004
• Issued: 11/20/2007
• Est. Priority Date: 01/06/2000
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Pearce, Christopher L., Kim, Do K., Constantine, Jeffrey J.
• Primary Examiner(s): Arani; Taghi
• Assistant Examiner(s): Jackson; Jenise E.
• Application Number:
  US10/756,682
• Time in Patent Office: 1,408 Days
• Field of Search: 713/165, 726/2, 726/24, 726/4
• US Class Current: 713/188
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system and method are provided for protecting a user computer. An incoming e-mail message is initially received at a remote e-mail server over a network. Further, the incoming e-mail message is blocked if a sender address associated therewith is included in a list of predetermined sender addresses corresponding to a user computer. Moreover, the incoming e-mail message is scanned for a virus to determine that the incoming e-mail message is clean if the scanning fails to detect a virus in the incoming e-mail message and to determine that the incoming e-mail message is infected in the scanning detects a virus in the incoming e-mail message. Still yet, the incoming e-mail message is transmitted from the remote e-mail sever to the user computer over the network, if it is not blocked. An attempt is made to clean the infected incoming e-mail message if the scanning detects a virus in the incoming e-mail message to generate a cleaned e-mail message if the attempt to clean is successful. In use, a text message is transmitted to the user computer, indicating results of the scanning.

Claims

1. A method for protecting a user computer, comprising:

receiving an incoming e-mail message at a remote e-mail server over a network;

blocking the incoming e-mail message if a sender address associated therewith is included in a list of predetermined sender addresses corresponding to a user computer;

scanning the incoming e-mail message for a virus to determine that the incoming e-mail message is clean if the scanning fails to detect a virus in the incoming e-mail message and to determine that the incoming e-mail message is infected if the scanning detects a virus in the incoming e-mail message;

transmitting the incoming e-mail message from the remote e-mail server to the user computer over the network, if it is not blocked; and

attempting to clean the infected incoming e-mail message if the scanning detects a virus in the incoming e-mail message to generate a cleaned e-mail message if the attempt to clean is successful;

wherein a text message is transmitted to the user computer if the scanning detects the virus in the incoming e-mail message, indicating results of the scanning, the text message being included in the cleaned e-mail message if the attempt to clean is successful;

wherein the text message is inserted in a subject header of the cleaned e-mail message, the text message being inserted at a beginning of the subject header of the cleaned e-mail message or appended at an end of the subject header of the cleaned e-mail message.

2. The method for protecting the user computer to claim 1, wherein the list is associated with a user profile corresponding to the user computer, the user profile requiring a username and a password to modify the list.

3. The method for protecting the user computer according to claim 1, further comprising deleting the incoming e-mail message from the remote e-mail server, if it is blocked.

4. The method for protecting the user computer according to claim 1, wherein at least an infected portion of the infected incoming e-mail message includes an attachment, and only deleting the attachment if it is infected.

5. The method for protecting the user computer according to claim 1, further comprising quarantining the infected incoming e-mail message to a remote quarantine server.

6. The method for protecting the user computer according to claim 1, further comprising deleting at least an infected portion of the infected incoming e-mail message after the attempt to clean the incoming e-mail message is unsuccessful.

7. The method for protecting the user computer according to claim 6, wherein the infected portion of the infected incoming e-mail message includes an e-mail attachment.

8. The method for protecting the user computer according to claim 7, wherein the deleting includes deleting the entire infected incoming e-mail message.

9. The method for protecting the user computer according to claim 1, further comprising storing the infected e-mail message in memory if the attempt to clean the incoming e-mail message is unsuccessful.

10. The method for protecting the user computer according to claim 9, further comprising performing the attempt to clean the infected incoming e-mail message at least once again after the storing.

11. A system for protecting a user computer, comprising:

logic for receiving an incoming e-mail message at a remote e-mail server over a network;

logic for blocking the incoming e-mail message if a sender address associated therewith is included in a list of predetermined sender addresses corresponding to a user computer;

logic for scanning the incoming e-mail message for a virus to determine that the incoming e-mail message is clean if the scanning fails to detect a virus in the incoming e-mail message and to determine that the incoming e-mail message is infected if the scanning detects a virus in the incoming e-mail message;

logic for transmitting the incoming e-mail message from the remote e-mail server to the user computer over the network, if it is not blocked;

logic for attempting to clean the infected incoming e-mail message if the scanning detects a virus in the incoming e-mail message to generate a cleaned e-mail message if the attempt to clean is successful; and

logic for transmitting a text message to the user computer if the scanning detects a virus in the incoming e-mail message, indicating results of the scanning, the text message being included in the cleaned e-mail message if the attempt to clean is successful;

wherein the text message is inserted in a subject header of the cleaned e-mail message, the text message being inserted at a beginning of the subject header of the cleaned e-mail message or appended at an end of the subject header of the cleaned e-mail message.

12. A computer program product embodied on a tangible computer readable medium for protecting a user computer;

computer code receiving an incoming e-mail message at a remote e-mail server over a network;

computer code for blocking the incoming e-mail message if a sender address associated therewith is included in a list of predetermined sender addresses corresponding to a user computer;

computer code for scanning the incoming e-mail message for a virus to determine that the incoming e-mail message is clean if the scanning fails to detect a virus in the incoming e-mail message, and to determine that the incoming e-mail message is infected if the scanning detects a virus in the incoming e-mail message;

computer code for transmitting the incoming e-mail message from the remote e-mail server to the user computer over the network, if it is not blocked;

computer code attempting to clean the infected incoming e-mail message if the scanning detects a virus in the incoming e-mail message to generate a cleaned e-mail message if the attempt to clean is successful; and

computer code for transmitting a text message to the user computer if the scanning detects the virus in the incoming e-mail message, indicating results of the scanning, the text message being included in the cleaned e-mail message if the attempt to clean is successful;

wherein the text message is inserted in a subject header of the cleaned e-mail message, the text message being inserted at a beginning of the subject header of the cleaned e-mail message or appended at an end of the subject header of the cleaned e-mail message.

13. The computer program product for protecting the user computer according to claim 12, wherein the list is associated with a user profile corresponding to the user computer, the user profile requiring a username and a password to modify the list.

14. The computer program product for protecting the user computer according to claim 12, further comprising computer code for deleting the incoming e-mail message from the remote e-mail server, if it is blocked.

15. The computer program product for protecting the user computer according to claim 12, wherein at least an infected portion of the infected incoming e-mail message includes an attachment, and only deleting the attachment if it is infected.

16. The computer program product for protecting the user computer according to claim 12, further comprising computer code for quarantining the infected incoming e-mail message to a remote quarantine server.

17. The computer program product for protecting the user computer according to claim 12, further comprising computer code for deleting at least an infected portion of the infected incoming e-mail message after the attempt to clean the incoming e-mail message is unsuccessful.

18. The computer program product for protecting the user computer according to claim 17, wherein the infected portion of the infected incoming e-mail message includes an e-mail attachment.

19. The computer program product for protecting the user computer according to claim 18, wherein the deleting includes deleting the entire infected incoming e-mail message.

20. The computer program product for protecting the user computer according to claim 12, further comprising computer code for storing the infected e-mail message in memory if the attempt to clean the incoming e-mail message is unsuccessful.

21. The computer program product for protecting the user computer according to claim 20, further comprising computer code for performing the attempt to clean the infected incoming e-mail message at least once again after the storing.