System and method for performing antivirus scans of files

• US 9,436,824 B1
• Filed: 03/15/2016
• Issued: 09/06/2016
• Est. Priority Date: 12/18/2015
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Lab A.O. Kaspersky
• Inventors: Levchenko, Vyacheslav I., Sobko, Andrey V.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/070,458
• Time in Patent Office: 175 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

Disclosed are system and method for performing antivirus scans of files. An exemplary method includes detecting, by an antivirus application executed by a hardware processor, opening of a file for writing of data to the file; performing, by the antivirus application, antivirus scan of at least a portion of the file; when the file is determined to be clean, obtaining a record of antivirus scans of the file; determining from the record a number of performed antivirus scans on the file by the antivirus application and a maximum number of required antivirus scans; when the number of performed antivirus scans is below the maximum number of required antivirus scans, continue antivirus scans of the file by the antivirus application; and when the number of performed antivirus scan is equal to the maximum number of required antivirus scans, discontinue antivirus scans of the file by the antivirus application.

Claims

1. A method for performing antivirus scans of files, the method comprising:

detecting, by an antivirus application executed by a hardware processor, opening of a file for writing of data to the file;

performing, by the antivirus application, antivirus scan of at least a portion of the file;

when the file is determined to be clean, obtaining a record of antivirus scans of the file;

determining from the record a number of performed antivirus scans on the file by the antivirus application and a maximum number of required antivirus scans;

increasing by one the number of performed antivirus scans;

when the increased number of performed antivirus scans is below the maximum number of required antivirus scans, continue antivirus scans of the file by the antivirus application; and

when the increased number of performed antivirus scan is equal to the maximum number of required antivirus scans, discontinue antivirus scans of the file by the antivirus application.

2. The method of claim 1, wherein performing, by the antivirus application, antivirus scan of at least a portion of the file is performed after the writing of data to the file.

3. The method of claim 1, wherein performing, by the antivirus application, antivirus scan of at least a portion of the file includes performing one of an asynchronous and synchronous antivirus analysis of at least a portion of the file.

4. The method of claim 1, further comprising:

adjusting the maximum number of required antivirus scans based one of more factors, including a size of the data written into the file and a size of the system cache.

5. The method of claim 1, further comprising:

selecting one or more antivirus scan methods based on the number of performed antivirus scans and results of said scans.

6. A system for performing antivirus scans of files, the system comprising:

a hardware processor executing an antivirus application configured to;

detect opening of a file for writing of data to the file;

performing antivirus scan of at least a portion of the file;

when the file is determined to be clean, obtain a record of antivirus scans of the file;

determine from the record a number of performed antivirus scans on the file by the antivirus application and a maximum number of required antivirus scans;

increase by one the number of performed antivirus scans;

when the increased number of performed antivirus scans is below the maximum number of required antivirus scans, continue antivirus scans of the file; and

when the increased number of performed antivirus scan is equal to the maximum number of required antivirus scans, discontinue antivirus scans of the file.

7. The system of claim 6, wherein the antivirus application is further configured to perform antivirus scan of at least a portion of the file after the writing of data to the file.

8. The system of claim 6, wherein the antivirus application is configured to perform one of an asynchronous and synchronous antivirus analysis of at least a portion of the file.

9. The system of claim 6, wherein the antivirus application is further configured to adjust the maximum number of required antivirus scans based one of more factors, including a size of the data written into the file and a size of the system cache.

10. The system of claim 6, wherein the antivirus application is further configured to select one or more antivirus scan methods based on the number of performed antivirus scans and results of said scans.

11. A non-transitory computer readable medium storing computer executable instructions for performing antivirus scans of files, including instructions for:

detecting, by an antivirus application executed by a hardware processor, opening of a file for writing of data to the file;

performing, by the antivirus application, antivirus scan of at least a portion of the file;

when the file is determined to be clean, obtaining a record of antivirus scans of the file;

determining from the record a number of performed antivirus scans on the file by the antivirus application and a maximum number of required antivirus scans;

increasing by one the number of performed antivirus scans;

when the increased number of performed antivirus scans is below the maximum number of required antivirus scans, continue antivirus scans of the file by the antivirus application; and

when the increased number of performed antivirus scan is equal to the maximum number of required antivirus scans, discontinue antivirus scans of the file by the antivirus application.

12. The non-transitory computer readable medium of claim 11, wherein performing, by the antivirus application, antivirus scan of at least a portion of the file is performed after the writing of data to the file.

13. The non-transitory computer readable medium of claim 11, wherein performing, by the antivirus application, antivirus scan of at least a portion of the file includes performing one of an asynchronous and synchronous antivirus analysis of at least a portion of the file.

14. The non-transitory computer readable medium of claim 11, further comprising:

adjusting the maximum number of required antivirus scans based one of more factors, including a size of the data written into the file and a size of the system cache.

15. The non-transitory computer readable medium of claim 11, further comprising:

selecting one or more antivirus scan methods based on the number of performed antivirus scans and results of said scans.