Managing infectious forwarded messages

• US 9,237,163 B2
• Filed: 12/19/2014
• Issued: 01/12/2016
• Est. Priority Date: 07/13/2004
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Rihn, Jennifer, Oliver, Jonathan J.
• Primary Examiner(s): LEWIS, LISA C
• Application Number:
  US14/578,065
• Publication Number:
  US 20150106936A1
• Time in Patent Office: 389 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Systems and methods for managing forwarded infectious messages are provided. Managing electronic message comprises receiving a message, forwarding the message, determining that the forwarded message is infectious after the message has been forwarded and preventing the infectious forwarded message from spreading.

Claims

1. A method of managing messages, the method comprising:

receiving a first message over a network at a network interface, the first message including an attachment file having a file name and an embedded bit pattern;

executing instructions stored in memory, wherein execution of the instructions by a processor;

determines that the attachment file is executable based on the embedded bit pattern,

determines that the attachment file is a text file based on the file name,

stores a copy of the first message in memory based on the disparity between the determination that the attachment file is executable and the determination that the attachment file is a text file, and

transmits the first message over the network to a mail server;

receiving a second message over the network at the network interface; and

executing instructions stored in memory, wherein execution of the instructions by a processor;

compares the second message to the copy of the transmitted first message stored in memory,

deletes the second message from a local send queue, and sends a cancellation request concerning the transmitted first message to the mail server, the deletion and cancellation request occurring automatically when the second message matches the copy of the transmitted first message in memory.

2. The method of claim 1, wherein further execution of the instructions reports the match to a system administrator.

3. The method of claim 1, wherein further execution of the instructions reports the match to a recipient of the first message.

4. The method of claim 1, wherein further execution of the instructions reports the match to a designated recipient of the second message.

5. The method of claim 1, wherein further execution of the instructions quarantines the second message.

6. The method of claim 1, wherein the file name includes a .txt extension.

7. The method of claim 1, wherein the file name includes a .doc extension.

8. An electronic message management system, comprising:

a network interface that;

receives a first message over a network, the first message including an attachment file having a file name and an embedded bit pattern,

transmits the first message over the network to a mail server, and

receives a second message over the network at the network interface after transmitting the first message to the mail server;

a memory that stores instructions; and

a processor communicatively coupled to the memory and the network interface, wherein execution of the instructions stored in the memory by the processor;

determines that the attachment file of the first message is executable based on the embedded bit pattern,

determines that the attachment file of the first message is a text file based on the file name,

stores a copy of the first message in memory based on the disparity between the determination that the attachment file is executable and the determination that the attachment file is a text file,

compares the second message received after transmission of the first message to the copy of the transmitted first message stored in memory,

deletes the second message from a local send queue, and sends a cancellation request concerning the transmitted first message to the mail server, the deletion and cancellation request occurring automatically when the second message matches the copy of the transmitted first message in memory.

9. The system of claim 8, wherein further execution of the instructions reports the match to a system administrator.

10. The system of claim 8, wherein further execution of the instructions reports the match to a recipient of the first message.

11. The system of claim 8, wherein further execution of the instructions reports the match to a designated recipient of the second message.

12. The system of claim 8, wherein further execution of the instructions quarantines the second message.

13. The system of claim 8, wherein the file name includes a .txt extension.

14. The system of claim 8, wherein the file name includes a .doc extension.

15. A non-transitory computer readable storage medium, the medium having a computer program embodied thereon, the program executable by a processor to perform a method of managing messages, the method comprising:

analyzing a first message received over a network at a network interface, the first message including an attachment file having a file name and an embedded bit pattern, wherein analyzing the first message includes;

determining that the attachment file is executable based on the embedded bit pattern, and

determining that the attachment file is a text file based on the file name;

storing a copy of the first message in memory based on the disparity between the determination that the attachment file is executable and the determination that the attachment file is a text file;

transmitting the first message over the network to a mail server;

comparing a second message received over the network at the network interface to the copy of the transmitted first message stored in memory;

deleting the second message from a local send queue; and

sending a cancellation request concerning the transmitted first message to the mail server, the deletion and cancellation request occurring automatically when the second message matches the copy of the transmitted first message in memory.

16. The non-transitory computer readable storage medium of claim 15, wherein the method further includes reporting the match to a system administrator.

17. The non-transitory computer readable storage medium of claim 15, wherein the method further includes reporting the match to a recipient of the first message.

18. The non-transitory computer readable storage medium of claim 15, wherein the method further includes reporting the match to a designated recipient of the second message.

19. The non-transitory computer readable storage medium of claim 15, wherein the method further includes quarantining the second message.

20. The non-transitory computer readable storage medium of claim 15, wherein the file name includes either a .txt or .doc extension.