Virus scanner for journaling file system

• US 20070136810A1
• Filed: 12/07/2005
• Published: 06/14/2007
• Est. Priority Date: 12/07/2005
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Inventors: Davis, Mark, Mese, John, Kelso, Scott, Peterson, Nathan, Weksler, Arnold, Waltermann, Rod
• Granted Patent: US 7,845,008 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A method is provided for detecting viruses. According to the method, data is stored in a journal area of memory before changes embodied in the data are written to virtual memory. At least a first portion of the data in the journal area of memory is scanned for viruses. In some embodiments, a second portion of data that immediately precedes and/or immediately follows data to which the first portion of the data pertains is scanned for viruses. Preferably, the virtual memory includes a persistent storage device. Also provided is a system that includes a processor, a memory that includes virtual memory and a journal storage area, and a virus scanner controlled by the processor. The virus scanner scans the journal storage area for viruses.

Claims

1. A method for detecting viruses, the method comprising the steps of:

storing data in a journal area of memory before changes embodied in the data are written to virtual memory; and

scanning at least a first portion of the data in the journal area of memory for viruses.

2. The method according to claim 1, further comprising the step of scanning a second portion of data for viruses, the second portion of data being data that immediately precedes data to which the first portion of the data pertains.

3. The method according to claim 2, wherein the second portion of data is also stored in the journal area of memory.

4. The method according to claim 2, wherein the second portion of data is stored in the virtual memory.

5. The method according to claim 1, further comprising the step of scanning a second portion of data for viruses, the second portion of data being data that immediately follows data to which the first portion of the data pertains.

6. The method according to claim 5, wherein the second portion of data is also stored in the journal area of memory.

7. The method according to claim 5, wherein the second portion of data is stored in the virtual memory.

8. The method according to claim 1, wherein the journal area of memory is used exclusively for storing data output by a journaling system.

9. The method according to claim 1, wherein the virtual memory includes a persistent storage device.

10. A system comprising:

a processor;

a memory coupled to the processor and readable by the processor, the memory including virtual memory and a journal storage area; and

a virus scanner controlled by the processor, the virus scanner scanning the journal storage area for viruses,

wherein data is stored in the journal area before changes embodied in the data are written to virtual memory.

11. The system according to claim 10, wherein the virus scanner scans a journal entry stored in the journal storage area, and a portion of data that immediately precedes data to which the journal entry pertains.

12. The system according to claim 11, wherein the portion of data is also stored in the journal storage area.

13. The system according to claim 11, wherein the portion of data is stored in the virtual memory.

14. The system according to claim 10, wherein the virus scanner scans a journal entry stored in the journal storage area, and a portion of data that immediately follows data to which the journal entry pertains.

15. The system according to claim 14, wherein the portion of data is also stored in the journal storage area.

16. The system according to claim 14, wherein the portion of data is also stored in the virtual memory.

17. The system according to claim 10, wherein the virtual memory includes a persistent storage device.

18. A computer-readable medium encoded with a program for detecting viruses, the program comprising instructions for performing the steps of:

storing data in a journal area of memory before changes embodied in the data are written to virtual memory; and

scanning at least a first portion of the data in the journal area of memory for viruses.

19. The computer-readable medium according to claim 18, wherein the program further comprises instructions for performing the step of scanning a second portion of data for viruses, the second portion of data being data that immediately precedes data to which the first portion of the data pertains.

20. The computer-readable medium according to claim 18, wherein the program further comprises instructions for performing the step of scanning a second portion of data for viruses, the second portion of data being data that immediately follows data to which the first portion of the data pertains.