Malware scanning user interface for wireless devices

• US 7,827,611 B2
• Filed: 04/12/2002
• Issued: 11/02/2010
• Est. Priority Date: 08/01/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Palmer, David W., Libenzi, Davide, Fallenstedt, Martin, Kouznetsov, Victor, Pak, Michael C.
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US10/122,095
• Publication Number:
  US 20040025042A1
• Time in Patent Office: 3,126 Days
• Field of Search: 380/270, 726 22- 25, 719/320, 719328-329
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

A system, method and computer program product are provided for scanning a mobile wireless device for malware. Initially, an update command is received from a user utilizing a graphical user interface of a mobile wireless device. An anti-malware scanner installed on the mobile wireless device is then updated over a wireless network in response to the update command. The mobile wireless device is then scanned utilizing the updated anti-malware scanner. Such anti-malware scanner may be conditionally updated based on the update command so as to regulate usage of the wireless network with the mobile wireless device.

Claims

1. A method for scanning a mobile wireless device for malware, comprising:

receiving an update command from a user utilizing a graphical user interface of a mobile wireless device;

updating an anti-malware scanner installed on the mobile wireless device over a wireless network in response to the update command; and

scanning the mobile wireless device utilizing the updated anti-malware scanner;

wherein the anti-malware scanner is conditionally updated based on the update command so as to regulate usage of the wireless network with the mobile wireless device;

wherein the mobile wireless device is updated in a manner that is coordinated with a plurality of other mobile wireless devices for maintaining the performance of the wireless network;

wherein scanning the mobile wireless device includes scanning data stored in persistent memory of the mobile wireless device;

wherein the data is accessed utilizing an abstract file system interface;

wherein the abstract file system interface is implemented for each class of the data stored in the persistent memory;

wherein the update command includes data specific to the mobile wireless device;

wherein the abstract file system interface includes data structures with call back functions that manipulate the data by writing bytes to the data, setting a new size of the data, changing a read/write access mode to the data, and de-allocating resources used for the data;

wherein the anti-malware scanner utilizes a platform abstraction layer that includes a storage I/O component utilized to access and modify objects stored on a storage device and managed by a file system, a network socket I/O component utilized to create a socket, initialize a socket, accept a socket, read from a socket, write to a socket, and close a socket, a process control component utilized to list processes, free a process, terminate a process, open a process, and close a process, a memory component utilized to allocate memory and free memory, an event handler component utilized to set an event hander and get an event handler, a system information component utilized to get an identification code associated with the mobile wireless device, an error status component utilized to set an error and get a last error, and a miscellaneous component utilized to suspend execution for a time, set memory, copy memory, execute a buffer, and execute a file.

2. The method as recited in claim 1, wherein a version number of a last update is displayed utilizing the graphical user interface of the mobile wireless device.

3. The method as recited in claim 1, wherein a time of a last update is displayed utilizing the graphical user interface of the mobile wireless device.

4. The method as recited in claim 1, wherein the update command is received upon the selection of an update icon displayed on the graphical user interface of the mobile wireless device.

5. The method as recited in claim 1, wherein the mobile wireless device is scanned utilizing the updated anti-malware scanner in response to a scan command from the user.

6. The method as recited in claim 5, wherein the scan command is received upon the selection of a scan icon displayed on the graphical user interface of the mobile wireless device.

7. The method as recited in claim 1, wherein the abstract file system interface includes an abstract directory interface.

8. The method as recited in claim 1, wherein the call back functions enumerate the data.

9. The method as recited in claim 8, wherein enumerating the data includes opening a first entry in a directory.

10. The method as recited in claim 9, wherein entries in the directory are not sorted.

11. The method as recited in claim 9, wherein enumerating the data includes closing the first entry before opening another entry.

12. The method as recited in claim 1, wherein the update is tailored for the mobile wireless device based on the data specific to the mobile wireless device.

13. The method as recited in claim 1, wherein a class of the data includes a file system.

14. The method as recited in claim 1, wherein a class of the data includes a database.

15. The method as recited in claim 1, wherein a class of the data includes a custom persistent data storage on the mobile wireless device.

16. A computer program product embodied on a tangible non-transitory computer readable medium, comprising:

computer code for receiving an update command from a user utilizing a graphical user interface of a mobile wireless device;

computer code for updating an anti-malware scanner installed on the mobile wireless device over a wireless network in response to the update command; and

computer code for scanning the mobile wireless device utilizing the updated anti-malware scanner;

wherein the computer program product is operable such that the anti-malware scanner is conditionally updated based on the update command so as to regulate usage of the wireless network with the mobile wireless device;

wherein the computer program product is operable such that the mobile wireless device is updated in a manner that is coordinated with a plurality of other mobile wireless devices for maintaining the performance of the wireless network;

wherein the computer program product is operable such that scanning the mobile wireless device includes scanning data stored in persistent memory of the mobile wireless device;

wherein the computer program product is operable such that the data is accessed utilizing an abstract file system interface;

wherein the computer program product is operable such that the abstract file system interface is implemented for each class of the data stored in the persistent memory;

wherein the computer program product is operable such that the update command includes data specific to the mobile wireless device;

wherein the computer program product is operable such that the abstract file system interface includes data structures with call back functions that manipulate the data by writing bytes to the data, setting a new size of the data, changing a read/write access mode to the data, and de-allocating resources used for the data;

wherein the anti-malware scanner utilizes a platform abstraction layer that includes a storage I/O component utilized to access and modify objects stored on a storage device and managed by a file system, a network socket I/O component utilized to create a socket, initialize a socket, accept a socket, read from a socket, write to a socket, and close a socket, a process control component utilized to list processes, free a process, terminate a process, open a process, and close a process, a memory component utilized to allocate memory and free memory, an event handler component utilized to set an event hander and get an event handler, a system information component utilized to get an identification code associated with the mobile wireless device, an error status component utilized to set an error and get a last error, and a miscellaneous component utilized to suspend execution for a time, set memory, copy memory, execute a buffer, and execute a file.

17. The computer program product as recited in claim 16, wherein a version number of a last update is displayed utilizing the graphical user interface of the mobile wireless device.

18. The computer program product as recited in claim 16, wherein a time of a last update is displayed utilizing the graphical user interface of the mobile wireless device.

19. The computer program product as recited in claim 16, wherein the update command is received upon the selection of an update icon displayed on the graphical user interface of the mobile wireless device.

20. The computer program product as recited in claim 16, wherein the mobile wireless device is scanned utilizing the updated anti-malware scanner in response to a scan command from the user.

21. The computer program product as recited in claim 20, wherein the scan command is received upon the selection of a scan icon displayed on the graphical user interface of the mobile wireless device.

22. A system, comprising:

logic for receiving an update command from a user utilizing a mobile wireless device;

logic for updating an anti-malware scanner installed on the mobile wireless device over a wireless network in response to the update command; and

logic for scanning the mobile wireless device utilizing the updated anti-malware scanner;

wherein the system is operable such that the anti-malware scanner is conditionally updated based on the update command so as to regulate usage of the wireless network with the mobile wireless device;

wherein the system is operable such that the mobile wireless device is updated in a manner that is coordinated with a plurality of other mobile wireless devices for maintaining the performance of the wireless network;

wherein the system is operable such that scanning the mobile wireless device includes scanning data stored in persistent memory of the mobile wireless device;

wherein the system is operable such that the data is accessed utilizing an abstract file system interface;

wherein the system is operable such that the abstract file system interface is implemented for each class of the data stored in the persistent memory;

wherein the system is operable such that the update command includes data specific to the mobile wireless device;

wherein the system is operable such that the abstract file system interface includes data structures with call back functions that manipulate the data by writing bytes to the data, setting a new size of the data, changing a read/write access mode to the data, and de-allocating resources used for the data;

wherein the anti-malware scanner utilizes a platform abstraction layer that includes a storage I/O component utilized to access and modify objects stored on a storage device and managed by a file system, a network socket I/O component utilized to create a socket, initialize a socket, accept a socket, read from a socket, write to a socket, and close a socket, a process control component utilized to list processes, free a process, terminate a process, open a process, and close a process, a memory component utilized to allocate memory and free memory, an event handler component utilized to set an event hander and get an event handler, a system information component utilized to get an identification code associated with the mobile wireless device, an error status component utilized to set an error and get a last error, and a miscellaneous component utilized to suspend execution for a time, set memory, copy memory, execute a buffer, and execute a file.

23. The system as recited in claim 22, wherein a version number of a last update is displayed utilizing the graphical user interface of the mobile wireless device.

24. The system as recited in claim 22, wherein a time of a last update is displayed utilizing the graphical user interface of the mobile wireless device.

25. The system as recited in claim 22, wherein the update command is received upon the selection of an update icon displayed on the graphical user interface of the mobile wireless device.

26. The system as recited in claim 22, wherein the mobile wireless device is scanned utilizing the updated anti-malware scanner in response to a scan command from the user.

27. The system as recited in claim 26, wherein the scan command is received upon the selection of a scan icon displayed on the graphical user interface of the mobile wireless device.

28. A system, comprising:

a mobile wireless device;

a graphical user interface displayed on the mobile wireless device for receiving an update command from a user;

an anti-malware scanner installed on the mobile wireless device for being updated over a wireless network in response to the update command, and scanning the mobile wireless device;

wherein the system is operable such that the anti-malware scanner is conditionally updated based on the update command so as to regulate usage of the wireless network with the mobile wireless device;

wherein the system is operable such that the mobile wireless device is updated in a manner that is coordinated with a plurality of other mobile wireless devices for maintaining the performance of the wireless network;

wherein the system is operable such that scanning the mobile wireless device includes scanning data stored in persistent memory of the mobile wireless device;

wherein the system is operable such that the data is accessed utilizing an abstract file system interface;

wherein the system is operable such that the abstract file system interface is implemented for each class of the data stored in the persistent memory;

wherein the system is operable such that the update command includes data specific to the mobile wireless device;

wherein the system is operable such that the abstract file system interface includes data structures with call back functions that manipulate the data by writing bytes to the data, setting a new size of the data, changing a read/write access mode to the data, and de-allocating resources used for the data;

wherein the anti-malware scanner utilizes a platform abstraction layer that includes a storage I/O component utilized to access and modify objects stored on a storage device and managed by a file system, a network socket I/O component utilized to create a socket, initialize a socket, accept a socket, read from a socket, write to a socket, and close a socket, a process control component utilized to list processes, free a process, terminate a process, open a process, and close a process, a memory component utilized to allocate memory and free memory, an event handler component utilized to set an event hander and get an event handler, a system information component utilized to get an identification code associated with the mobile wireless device, an error status component utilized to set an error and get a last error, and a miscellaneous component utilized to suspend execution for a time, set memory, copy memory, execute a buffer, and execute a file.

29. A system, comprising:

means for receiving an update command from a user utilizing a mobile wireless device;

means for updating an anti-malware scanner installed on the mobile wireless device over a wireless network in response to the update command; and

means for scanning the mobile wireless device utilizing the updated anti-malware scanner;

wherein the system is operable such that the anti-malware scanner is conditionally updated based on the update command so as to regulate usage of the wireless network with the mobile wireless device;

wherein the system is operable such that the mobile wireless device is updated in a manner that is coordinated with a plurality of other mobile wireless devices for maintaining the performance of the wireless network;

wherein the system is operable such that scanning the mobile wireless device includes scanning data stored in persistent memory of the mobile wireless device;

wherein the system is operable such that the data is accessed utilizing an abstract file system interface;

wherein the system is operable such that the abstract file system interface is implemented for each class of the data stored in the persistent memory;

wherein the system is operable such that the update command includes data specific to the mobile wireless device;

wherein the system is operable such that the abstract file system interface includes data structures with call back functions that manipulate the data by writing bytes to the data, setting a new size of the data, changing a read/write access mode to the data, and de-allocating resources used for the data;

wherein the anti-malware scanner utilizes a platform abstraction layer that includes a storage I/O component utilized to access and modify objects stored on a storage device and managed by a file system, a network socket I/O component utilized to create a socket, initialize a socket, accept a socket, read from a socket, write to a socket, and close a socket, a process control component utilized to list processes, free a process, terminate a process, open a process, and close a process, a memory component utilized to allocate memory and free memory, an event handler component utilized to set an event hander and get an event handler, a system information component utilized to get an identification code associated with the mobile wireless device, an error status component utilized to set an error and get a last error, and a miscellaneous component utilized to suspend execution for a time, set memory, copy memory, execute a buffer, and execute a file.

30. A method for scanning a mobile wireless device for malware, comprising:

receiving an update command from a user utilizing a graphical user interface of a mobile wireless device, wherein the update command is received upon the selection of an update icon displayed on the graphical user interface of the mobile wireless device;

updating an anti-malware scanner installed on the mobile wireless device over a wireless network in response to the update command; and

scanning the mobile wireless device utilizing the updated anti-malware scanner, wherein the mobile wireless device is scanned utilizing the updated anti-malware scanner in response to a scan command from the user;

wherein the user is charged for the update based on usage of the wireless network;

wherein the mobile wireless device is updated in a manner that is coordinated with a plurality of other mobile wireless devices for maintaining the performance of the wireless network;

wherein scanning the mobile wireless device includes scanning data stored in persistent memory of the mobile wireless device;

wherein the data is accessed utilizing an abstract file system interface;

wherein the abstract file system interface is implemented for each class of the data stored in the persistent memory;

wherein the update command includes data specific to the mobile wireless device;

wherein the abstract file system interface includes data structures with call back functions that manipulate the data by writing bytes to the data, setting a new size of the data, changing a read/write access mode to the data, and de-allocating resources used for the data;

wherein the anti-malware scanner utilizes a platform abstraction layer that includes a storage I/O component utilized to access and modify objects stored on a storage device and managed by a file system, a network socket I/O component utilized to create a socket, initialize a socket, accept a socket read from a socket, write to a socket, and close a socket, a process control component utilized to list processes, free a process, terminate a process, open a process, and close a process, a memory component utilized to allocate memory and free memory, an event handler component utilized to set an event hander and get an event handler, a system information component utilized to get an identification code associated with the mobile wireless device, an error status component utilized to set an error and get a last error, and a miscellaneous component utilized to suspend execution for a time, set memory, copy memory, execute a buffer, and execute a file.