Instant messaging (IM) comforting in antivirus filtering system and method

• US 7,634,814 B1
• Filed: 08/31/2005
• Issued: 12/15/2009
• Est. Priority Date: 08/31/2005
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sobel, William E., McCorkendale, Bruce
• Primary Examiner(s): LaForgia; Christian
• Assistant Examiner(s): Baum; Ronald
• Application Number:
  US11/218,206
• Time in Patent Office: 1,567 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A computer implemented method includes intercepting transfer of an IM attachment, providing a comforting message that the IM attachment is being delayed, and evaluating the IM attachment for malicious code. Upon a determination that the IM attachment is non-malicious, the IM attachment is transferred to the recipient IM user. By explaining the delay in receipt of the IM attachment, the recipient IM user is prevented from becoming disconcerted about the delay.

Claims

1. A computer implemented method comprising:

intercepting transfer of an instant messaging (IM) attachment;

providing a comforting message on a display device of a computer system that said IM attachment is being delayed because said IM attachment is being evaluated for malicious code, wherein said comforting message comprises a link to status information about said IM attachment comprising an estimated time remaining until said evaluation is completed; and

evaluating said IM attachment for malicious code, wherein upon completion of said evaluation, said status information is updated to provide results of said evaluation.

2. The computer implemented method of claim 1 further comprising transferring said IM attachment upon a determination that said IM attachment is safe.

3. The computer implemented method of claim 1 further comprising taking protective action upon a determination that said IM attachment comprises malicious code.

4. The computer implemented method of claim 3 further comprising providing a notification that said protective action has been taken.

5. The computer implemented method of claim 1 further comprising determining whether said IM attachment is to be scanned for said malicious code.

6. The computer implemented method of claim 5 wherein a determination is made that said IM attachment is not to be scanned for malicious code upon a determination that said IM attachment is a safe type of attachment.

7. The computer implemented method of claim 5 wherein a determination is made that said IM attachment is not to be scanned for malicious code upon a determination that said IM attachment is from a trusted source.

8. The computer implemented method of claim 1 further comprising scanning said IM attachment for said malicious code prior to said evaluating.

9. The computer implemented method of claim 8 wherein said scanning takes less time than said evaluating.

10. The computer implemented method of claim 8 wherein said scanning takes one second or less.

11. The computer implemented method of claim 8 wherein said evaluating is a non real-time event.

12. The computer implemented method of claim 8 further comprising determining that said IM attachment is suspicious based on said scanning.

13. The computer implemented method of claim 1 wherein said providing a comforting message comprises transferring a replacement attachment, wherein upon execution of said replacement attachment, said comforting message is displayed.

14. The computer implemented method of claim 13 wherein, upon a determination that said file IM attachment is safe, said replacement attachment automatically transfers said IM attachment.

15. The computer implemented method of claim 1 wherein said evaluating takes 5 minutes or more.

16. The computer implemented method of claim 1 wherein said evaluating comprises:

isolating said IM attachment;

executing said IM attachment; and

observing a behavior of said IM attachment during said execution.

17. The computer implemented method of claim 16 wherein a determination is made that said IM attachment is malicious upon a determination that said behavior is malicious.

18. A computer system comprising:

a memory having stored therein an instant messaging (IM) comforting application; and

a processor coupled to said memory, wherein execution of said IM comforting application generates a method comprising;

intercepting transfer of an instant messaging (IM) attachment;

providing a comforting message on a display device of a computer system that said IM attachment is being delayed because said IM attachment is being evaluated for malicious code, wherein said comforting message comprises a link to status information about said IM attachment comprising an estimated time remaining until said evaluation is completed; and

evaluating said IM attachment for malicious code, wherein upon completion of said evaluation, said status information is updated to provide results of said evaluation.

19. A computer-program product comprising a computer readable storage medium containing computer program code comprising:

an instant messaging (IM) comforting application for intercepting transfer of an instant messaging (IM) attachment;

said IM comforting application further for providing a comforting message on a display device of a computer system that said IM attachment is being delayed because said IM attachment is being evaluated for malicious code, wherein said comforting message comprises a link to status information about said IM attachment comprising an estimated time remaining until said evaluation is completed; and

said IM comforting application further for evaluating said IM attachment for malicious code, wherein upon completion of said evaluation, said status information is updated to provide results of said evaluation.

20. A computer system comprising:

a display device;

means for intercepting transfer of an instant messaging (IM) attachment;

means for providing a comforting message on said display device that said IM attachment is being delayed because said IM attachment is being evaluated for malicious code, wherein said comforting message comprises a link to status information about said IM attachment comprising an estimated time remaining until said evaluation is completed; and

means for evaluating said IM attachment for malicious code, wherein upon completion of said evaluation, said status information is updated to provide results of said evaluation.