Blocking e-mail propagation of suspected malicious computer code

• US 7,490,244 B1
• Filed: 09/14/2004
• Issued: 02/10/2009
• Est. Priority Date: 09/14/2004
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Nachenberg, Carey, Sobel, William E., Kennedy, Mark, McCorkendale, Bruce
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Baum; Ronald
• Application Number:
  US10/941,527
• Time in Patent Office: 1,610 Days
• Field of Search: 713/188
• US Class Current: 713/188
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Methods, apparatuses, and computer-readable media for preventing the spread of malicious computer code. An embodiment of the inventive method comprises the steps of: identifying (110) a computer application that is data mining an e-mail address; determining (130) whether the computer application associates at least one executable application and the data mined e-mail address with an e-mail message (120); and blocking (140) the transmission of the e-mail message when the e-mail message is associated with the at least one executable application and the data mined e-mail address.

Claims

1. A method for preventing the spread of malicious computer code, the method comprising:

identifying a computer application that is data mining an e-mail address;

determining whether the computer application associates at least one executable application and the data mined e-mail address with an e-mail message; and

blocking transmission of the e-mail message when the e-mail message is associated with the at least one executable application and the data mined e-mail address.

2. The method of claim 1 further comprising the step of creating a notification that the transmission of the e-mail message has been blocked.

3. The method of claim 1 wherein data mining comprises opening a computer file.

4. The method of claim 3 wherein data mining further comprises extracting the e-mail address from the opened computer file.

5. The method of claim 3 wherein data mining further comprises extracting e-mail address data from the opened computer file.

6. The method of claim 1 wherein data mining comprises opening an EML file.

7. The method of claim 1 wherein data mining comprises opening a HTML file.

8. The method of claim 1 wherein data mining comprises opening a DBX file.

9. The method of claim 1 wherein data mining comprises recreating the e-mail address from e-mail address related data included in an opened computer file.

10. The method of claim 1 wherein the identifying step comprises monitoring for use of at least one search string by the computer application to search for computer files.

11. The method of claim 1 wherein the identifying step comprises comparing a file type of a computer file that the computer application is data mining to file types known to contain an e-mail address.

12. The method of claim 1 wherein the at least one executable application comprises a substantially similar copy of the computer application that is data mining.

13. The method of claim 1 wherein the at least one executable application contains malicious computer code.

14. A method for preventing the propagation of malicious computer code from a computer, the method comprising:

determining whether a computer application is searching for a file containing electronic address information;

observing the computer application read the electronic address information from the file;

monitoring the computer application prepare an electronic message with the electronic address information;

detecting whether the computer application associates at least one executable application with the electronic message; and

responsive to detecting the computer application associate at least one executable application with the electronic message, blocking transmission of the electronic message.

15. The method of claim 14 wherein the determining step comprises determining whether the computer application finds the file.

16. The method of claim 14 wherein the determining step comprises determining whether the computer application opens the file.

17. The method of claim 14 wherein the determining step comprises comparing the file to file types known to contain electronic address information.

18. The method of claim 14 wherein the executable application is a copy of the computer application.

19. The method of claim 14 wherein the executable application contains malicious computer code.

20. The method of claim 14 further comprising the step of creating a notice that transmission of the electronic messages has been blocked.

21. The method of claim 14 wherein electronic address information includes at least one e-mail address.

22. The method of claim 14 wherein observing further comprises extracting electronic address information from the file.

23. The method of claim 14 wherein electronic address information includes at least one instant message address.

24. At least one computer-readable medium containing computer program instructions for preventing the spread of malicious computer code, the computer program instructions performing the steps of:

identifying a computer application that is data mining an e-mail address from a computer file;

monitoring for the computer application preparing an e-mail message addressed to the data mined e-mail address and comprising at least one executable application; and

responsive to the computer application creating the e-mail message addressed to the data mined e-mail address and comprising the at least one executable application, blocking the transmission of the e-mail message.

25. The at least one computer-readable medium of claim 24 wherein the computer program instructions further performs the step of creating a notification that the transmission of the e-mail message has been blocked.

26. The at least one computer-readable medium of claim 24 wherein data mining comprises opening the computer file.

27. The at least one computer-readable medium of claim 26 wherein data mining comprises extracting the e-mail address from the opened computer file.

28. The at least one computer-readable medium of claim 26 wherein data mining comprises extracting e-mail address data from the open computer file.

29. The at least one computer-readable medium of claim 28 wherein data mining comprises recreating the e-mail address from the extracted e-mail address data.

30. The at least one computer-readable medium of claim 24 wherein the identifying step further comprises monitoring for use of at least one search string by the computer application to search for computer files.

31. The at least one computer-readable medium of claim 24 wherein the identifying step further comprises comparing a file type of the computer file that the computer application is data mining to file types known to contain an e-mail address.

32. The at least one computer-readable medium of claim 24 wherein the at least one executable application comprises a substantially similar copy of the computer application that is data mining.

33. The at least one computer-readable medium of claim 24 wherein the at least one executable application contains malicious computer code.

34. Apparatus for preventing the spread of malicious computer code from a client computer to an e-mail server, the apparatus comprising:

a proxy module interposed between the client computer and the e-mail server, the proxy module comprising;

a monitor module adapted to identify a computer application that is data mining an e-mail address from the client computer and to determine whether the computer application associates at least one executable application and the data mined e-mail address with an e-mail message; and

coupled to the monitor module, a blocking module adapted to block the transmission of the e-mail message when the e-mail message is associated with the at least one executable application and the data mined e-mail address.

35. The apparatus of claim 34 wherein the monitor module is further adapted to compare a file type of a computer file that the computer application is data mining to file types known to contain an e-mail address.

36. The apparatus of claim 34 wherein the proxy module and the monitor module reside on the client computer.

37. The apparatus of claim 36 wherein the blocking module resides on the client computer.