Filtered antivirus scanning

• US 7,523,500 B1
• Filed: 06/08/2004
• Issued: 04/21/2009
• Est. Priority Date: 06/08/2004
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Vogel, Gregory D., Szor, Peter
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Baum; Ronald
• Application Number:
  US10/864,109
• Time in Patent Office: 1,778 Days
• Field of Search: 726/24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/563 by source code analysis

Abstract

An antivirus client module (114) includes a virus definitions module (312) holding information describing characteristics of files that can potentially be infected by viruses and information enabling a determination of whether a file is actually infected by a virus. The client module (114) also includes a filtering module (314) having a file information cache (410) describing characteristics of files. A file scanning module (316) can scan files to determine whether the files are infected by viruses. The antivirus client module (114) queries the file information cache (410) using the information describing characteristics of files to identify the set of files that are susceptible to a given virus. The file scanning module (316) scans the files in the set.

Claims

1. A computer program product comprising:

a computer-readable storage medium having executable computer program logic embodied therein for detecting computer viruses in files of a computer system, the computer program logic comprising;

a file typing module for

analyzing files of the computer system,

generating information describing

virus infection susceptibility characteristics of the files, and

storing the generated information in

a file information cache;

a file modification module for

detecting changes to the files and

updating the stored information for

changed files;

a virus definition module for

receiving from a remote server

a plurality of virus definitions and

holding the received virus definitions,

each virus definition

 

identifying a virus,

 

describing one or more characteristics of files

 

that are susceptible to the virus and

 

describing how to detect the virus

 

within a file;

a filter generation module for

receiving the characteristics of files

that are susceptible to a virus

 

as described by a virus definition and

querying the file information cache

using characteristics described by the virus definition to identify

 

a subset of files having the characteristics; and

a file scanning module for

receiving the description of how to

detect the virus within a file from

 

the virus definition and

examining the files within the subset

to determine whether a file

 

is infected by the virus.

2. The computer program product of claim 1, wherein a virus definition comprises:

filtering criteria specifying a set of logical conditions that are satisfied by files that are susceptible to the virus identified by the virus definition.

3. A method of detecting a computer virus in a computer system, comprising:

analyzing a set of files of the computer system and

generating information describing

virus infection susceptibility characteristics of the files;

storing the generated information in

a file information cache;

detecting changes to files in the set and

updating the stored information for

changed files;

receiving from a remote server a virus definition

identifying a virus and

including filtering criteria

describing characteristics of files

that are susceptible to infection by the virus;

querying the file information cache

using the filtering criteria to identify,

from the set of files of the computer system,

a subset of files that

satisfy the filtering criteria; and

examining the files within the subset

to determine whether a file

is infected with the virus.

4. The method of claim 3, wherein the identifying comprises:

applying the filtering criteria

to the information describing the virus infection susceptibility characteristics

of the files

to identify

the set of files.

5. The method of claim 3,

wherein the filtering criteria include

one or more logical conditions that are satisfied

by files that are susceptible to the virus, and

wherein the querying the file information cache comprises:

evaluating the logical conditions against

the files within the set of files

to identify any files

 

satisfying the logical conditions; and

adding to the subset

any files identified as

satisfying the logical conditions.

6. The method of claim 3, wherein the filtering criteria specify file types that are susceptible to infection by the virus.

7. The method of claim 3,

wherein the filtering criteria specify

techniques utilized by the virus

to infect files of the computer system.

8. The method of claim 3,

wherein generating information describing characteristics of the files comprise

setting flags for files

having characteristics satisfying the filtering criteria

in the virus definition

 

received from the remote server.

9. A system for detecting computer viruses in files of a computer system, comprising:

a computer-readable storage medium having executable computer program logic embodied therein, the computer program logic comprising;

a file typing module for

analyzing files of the computer system,

generating information describing

virus infection susceptibility characteristics of the files, and

storing the generated information in

a file information cache;

a file modification module for

detecting changes to the files and

updating the stored information for

changed files;

a virus definition module for

receiving from a remote server

a plurality of virus definitions and

holding the received virus definitions,

each virus definition

 

identifying a virus,

 

describing one or more characteristics of files

 

that are susceptible to the virus and

 

describing how to detect the virus

 

within a file;

a filter generation module for

receiving the characteristics of files

that are susceptible to a virus

 

as described by a virus definition and

querying the file information cache

using characteristics described by the virus definition to identify

 

a subset of files having the characteristics; and

a file scanning module for

receiving the description of how to

detect the virus within a file from

 

the virus definition and

examining the files within the subset

to determine whether a file

 

is infected by the virus.

10. The system of claim 9, wherein a virus definition comprises:

filtering criteria specifying a set of logical conditions that are satisfied by files that are susceptible to the virus identified by the virus definition.