File blocking mitigation

• US 7,797,742 B2
• Filed: 02/26/2007
• Issued: 09/14/2010
• Est. Priority Date: 02/26/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Sheldon, Elizabeth Jeanne, Kalra, Bikramjit S., Pullen, Walter D., Treacy, Ambrose T., Bailor, Jonathan B., Dandige, Maithili V.
• Primary Examiner(s): Chai; Longbit
• Application Number:
  US11/679,048
• Publication Number:
  US 20080209138A1
• Time in Patent Office: 1,296 Days
• Field of Search: 726/22
• US Class Current: 726/22
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

Embodiments are described for blocking the opening of a file. Some embodiments include receiving a request to open a file. In response, a portion of the file'"'"'s data is examined to determine a true file format for the file. A determination is then made as to whether the true file format of the file has been set as blocked. Based on the determination that the file format is blocked from opening, the file is prevented from being loaded into memory and from being accessed. A message is then displayed to a user indicating that the file has been blocked from opening.

Claims

1. A method of blocking the opening of a file, the method comprising:

configuring at least one processor to perform the steps of;

receiving a request to open a file;

examining a portion of the file'"'"'s data to determine a true file format for the file;

determining whether the true file format is of a format that is blocked from being opened, wherein an open block policy is stored in a registry and a registry key is used to set the open block policy for a file to prevent an application from opening a file of a specific file type and associated format;

based on the determining, blocking the opening of the file by preventing the loading of the file into memory and preventing access to the file; and

displaying a message indicating that the file has been blocked from opening.

2. The method of claim 1, wherein the examining, determining, blocking, and displaying is performed by an application that is capable of opening the file by loading the file into memory and providing access to the file.

3. The method of claim 1, wherein a file extension is not used to determine the true file format.

4. The method of claim 3, wherein the examining comprises identifying features within the portion of the file'"'"'s data that indicate the true file format.

5. The method of claim 4, wherein the features include header information and data structures.

6. The method of claim 1, wherein the determining comprises accessing an open block policy indicating a file type that is blocked from being opened, the true file format being associated with the file type.

7. The method of claim 1, further comprising after the receiving, determining whether the file is stored in a trusted location.

8. The method of claim 7, wherein in response to a determination that the file is stored in a trusted location:

bypassing the examining, determining, blocking, and displaying steps; and

opening the file by loading the file into memory and allowing access to the file.

9. The computer readable storage medium of claim 8, wherein the determining comprises accessing an open block policy indicating a file type that is blocked from being opened, the true file format being associated with the file type.

10. The computer readable storage medium of claim 9, wherein the trusted location is designated by an administrator in a registry key within the registry.

11. A computer readable storage medium encoding instructions, wherein the computer readable storage media does not consist of a propagated data signal, wherein when the encoded instructions are executed by a processor, results in a machine performing the functions of:

receiving by an application a request to open a file;

determining whether the file is stored in a trusted location;

in response to a determination that the file is stored in a trusted location, the application opening the file by loading the file into memory and allowing access to the file; and

in response to a determination that the file is not stored in a trusted location;

examining a portion of the file'"'"'s data to determine a true file format for the file;

determining whether the true file format is of a format that is blocked from being opened, wherein an open block policy is stored in a registry and a registry key is used to set the open block policy for a file to prevent an application from opening a file of a specific file type and associated format;

in response to the file not being of a type that is blocked from being opened, the application opening the file by loading the file into memory and allowing access to the file; and

in response to the file being of a type that is blocked from being opened, displaying a message indicating that the file has been blocked from opening.

12. The computer readable storage medium of claim 11, wherein a file extension is not used to determine the true file format.

13. The computer readable storage medium of claim 12, wherein the examining comprises identifying features within the portion of the file'"'"'s data that indicate the true file format.

14. The computer readable storage medium of claim 13, wherein the features include header information and data structures.

15. A method of blocking the saving of a file, the method comprising:

configuring at least one processor to perform the steps of;

receiving a request to save a file as a true file format;

examining a portion of the file'"'"'s data to determine a true file format for the file;

determining whether the true file format is of a format that is blocked from being saved, wherein a save block policy is stored in a registry and a registry key is used to set the save block policy for a file to prevent an application from saving a file of a specific file type and associated format;

based on the determining, blocking the saving of the file; and

displaying a message indicating that the file has been blocked from saving.

16. The method of claim 15, wherein if the request is received as part of an auto save operation:

bypassing the determining, blocking, and displaying steps; and

saving the file in the true file format; and

if the request is not received as part of an auto save operation, performing the determining, blocking, and displaying steps.

17. The method of claim 15, wherein the determining comprises accessing a save block policy indicating a file type that is blocked from being saved, the true file format being associated with the file type.