Apparatus and method for electronic mail virus detection and elimination

• US 5,889,943 A
• Filed: 03/29/1996
• Issued: 03/30/1999
• Est. Priority Date: 09/26/1995
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Ji, Shuang, Liang, Yung-Chang, Tsai, Warren, Chen, Eva
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): WRIGHT, NORMAN M
• Application Number:
  US08/625,800
• Time in Patent Office: 1,096 Days
• Field of Search: 395/183.14, 395/183.17, 395/183.18, 395/186, 395/187.01, 395/200.06, 380/4, 380/49, 364/269.4, 364/285.4, 364/286.4, 364/222.5, 340/825.34
• US Class Current: 726/22
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The detection and elimination of viruses on a computer network is disclosed. An apparatus for detecting and eliminating viruses which may be introduced by messages sent through a postal node of a network electronic mail system includes polling and retrieval modules in communication with the postal node to determine the presence of unscanned messages and to download data associated with them to a node for treatment by a virus analysis and treatment module. A method for detecting and eliminating viruses introduced by an electronic mail system includes polling the postal node for unscanned messages, downloading the messages into a memory of a node, and performing virus detection and analysis at the node.

Claims

1. An apparatus for detecting and selectively removing viruses in messages transferred using an electronic mail system, the apparatus comprising:

a message detecting module, for detecting the presence of a message; and

a virus analyzing module, in communication with the message detecting module, for determining whether data associated with the message contains a virus.

2. The apparatus of claim 1, further comprising:

a retrieval module, in communication with the message detecting module and the virus analyzing module, for obtaining a copy of the data associated with the message and providing the copy of data to the virus analyzing module.

3. The apparatus of claim 2, further comprising:

a virus treatment module, in communication with the virus analyzing module, for treating messages found to contain a virus.

4. The apparatus of claim 3, wherein the message is intended for access by a first node;

the message detecting module, the retrieval module, the virus analyzing module, and the virus treatment module reside at the first node; and

the message detected by the message detecting module resides at a second node.

5. The apparatus of claim 4, wherein the second node is a postal node in the electronic mail system.

6. The apparatus of claim 5, wherein the virus treatment module includes routines for replacing the attachment at the postal node with a cleaned attachment.

7. The apparatus of claim 1, wherein the message detecting module accesses a mailbox file in the detection of the message.

8. The apparatus of claim 7, wherein the message detecting module emulates polling routines used by the electronic mail system.

9. The apparatus of claim 4, wherein the message comprises a unique message identifier, a header, and at least one attachment.

10. The apparatus of claim 9, further comprising:

a data buffer, in communication with the retrieval module, for keeping a record associated with the message, the record including a first field for storing an indication of the unique message identifier and a second field for storing an indication of whether the message has been analyzed.

11. The apparatus of claim 9, wherein the virus treatment module includes routines for performing a preset action on the message when a virus is detected in the message.

12. The apparatus of claim 11, wherein the preset action performed by the virus treatment module comprises at least one of:

allowing message access by the first node without changing the message, preventing message access by the first node, notifying a party regarding the presence of the virus, and modifying the message to remove the virus.

13. The apparatus of claim 12, wherein the message modification performed by the virus treatment module to remove the virus comprises at least one of:

cleaning portions of the attachment, deleting the attachment, and stripping infected portions from the attachment.

14. The apparatus of claim 3, wherein the message is intended for access by a first node, the message detecting module and the virus treatment module reside at a server;

and the virus treatment module includes routines for performing a preset action on the message when a virus is detected in the message.

15. The apparatus of claim 14, wherein the preset action performed by the virus treatment module comprises at least one of:

allowing message access by the first node without changing the message, preventing message access by the first node, notifying a party regarding the presence of the virus, and modifying the message to remove the virus.

16. The apparatus of claim 15, wherein the message modification performed by the virus treatment module to remove the virus comprises at least one of:

cleaning portions of an attachment to the message, deleting the attachment, and stripping infected portions from the attachment.

17. A method for detecting and selectively removing viruses in messages transferred using an electronic mail system, the method comprising:

detecting the presence of a message; and

analyzing the message to determine whether data associated with the message contains a virus.

18. The method of claim 17, further comprising the steps of obtaining a copy of the data associated with the mail message and providing the copy of data for analysis.

19. The method of claim 18, further comprising:

treating messages found to contain a virus.

20. The method of claim 19, wherein the message is intended for access by a first node;

the steps of detecting the presence of a message and analyzing the message are undertaken at the first node; and

the message that is detected resides at a second node.

21. The method of claim 20, wherein the second node is a postal node in the electronic mail system.

22. The method of claim 21, wherein the step of treating the message comprises:

replacing an attachment at the postal node with a cleaned attachment, the attachment corresponding to the message.

23. The method of claim 17, wherein the step of detecting the presence of a message comprises accessing a mailbox file.

24. The method of claim 23, wherein the step of detecting the presence of a message comprises emulating the polling routines used by the electronic mail system.

25. The method of claim 20, wherein the message comprises a unique message identifier, a header, and at least one attachment.

26. The method of claim 25, further comprising:

recording the unique message identifier in a data buffer to log whether the message has been analyzed.

27. The method of claim 25, wherein the step of treating the message comprises performing a preset action on the message when a virus is detected in the message.

28. The method of claim 27, wherein the step of performing a preset action comprises at least one of the steps of:

allowing message access by the first node without changing the message, preventing message access by the first node, notifying a party regarding the presence of the virus, and modifying the message to remove the virus.

29. The method of claim 28, wherein the step of modifying the message to remove the virus comprises at least one of the steps of:

cleaning portions of the attachment, deleting the attachment, and stripping infected portions from the attachment.

30. The method of claim 19, wherein the message is intended for access by a first node, the step of detecting the presence of a message is undertaken at a server;

and the step of treating the message comprises performing a preset action on the message when a virus is detected in the message.

31. The method of claim 30, wherein the step of performing a preset action comprises at least one of the steps of:

allowing message access by the first node without changing the message, preventing message access by the first node, notifying a party regarding the presence of the virus, and modifying the message to remove the virus.

32. The method of claim 31, wherein the step of modifying the message to remove the virus comprises at least one of the steps of:

cleaning portions of the attachment, deleting the attachment, and stripping infected portions from the attachment.

33. An apparatus for detecting and selectively removing viruses in messages transferred using an electronic mail system, the apparatus comprising:

means for detecting the presence of a message;

means for analyzing the message to determine whether data associated with the message contains a virus.

34. The apparatus of claim 33, further comprising:

means for obtaining a copy of the data associated with the mail message.

35. The apparatus of claim 34, further comprising:

means for treating the message when the message is determined to contain a virus.

36. The apparatus of claim 35, wherein the message is intended for access by a first node;

the means for detecting the presence of a message resides at the first node; and

the message that is detected resides at a second node.

37. The apparatus of claim 36, wherein the second node is a postal node in the electronic mail system.

38. The apparatus of claim 37, wherein the means for treating the message comprises:

means for replacing an attachment at the postal node with a cleaned attachment, the attachment corresponding to the message.

39. The apparatus of claim 33, wherein the means for detecting the presence of a message comprises means for accessing a mailbox file.

40. The apparatus of claim 39, wherein the means for detecting the presence of a message emulates the polling routines used by the electronic mail system.

41. The apparatus of claim 36, wherein the message comprises a unique message identifier, a header, and at least one attachment.

42. The apparatus of claim 41, further comprising:

means for recording the unique message identifier in a data buffer to log whether the message has been analyzed.