Virus scanner for journaling file system

• US 7,845,008 B2
• Filed: 12/07/2005
• Issued: 11/30/2010
• Est. Priority Date: 12/07/2005
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Inventors: Waltermann, Rod D., Weksler, Arnold S., Peterson, Nathan J., Kelso, Scott E., Davis, Mark Charles, Mese, John C.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): RAHIM, MONJUR
• Application Number:
  US11/295,984
• Publication Number:
  US 20070136810A1
• Time in Patent Office: 1,819 Days
• Field of Search: 700/200, 707/202, 711/141, 711/150, 713/200, 714/38, 726/24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A method is provided for detecting viruses. According to the method, data is stored in a journal area of memory before changes embodied in the data are written to virtual memory. At least a first portion of the data in the journal area of memory is scanned for viruses. In some embodiments, a second portion of data that immediately precedes and/or immediately follows data to which the first portion of the data pertains is scanned for viruses. Preferably, the virtual memory includes a persistent storage device. Also provided is a system that includes a processor, a memory that includes virtual memory and a journal storage area, and a virus scanner controlled by the processor. The virus scanner scans the journal storage area for viruses.

Claims

1. A computer-implemented method for detecting viruses on a computer system, the computer system including a virtual memory and a journal area of memory, the method comprising the steps of:

storing data in the journal area of memory before changes embodied in the data are written to the virtual memory of the computer system; and

scanning, by a processor, a first portion of the data in the journal area of memory and a second portion of data in the virtual memory of the computer system for viruses, the second portion of data comprising data in the virtual memory that immediately precedes and/or immediately follows data in the virtual memory to which the first portion of the data in the journal area of memory pertains.

2. The method according to claim 1, wherein the second portion of data consists of the data in the virtual memory that immediately precedes the data in the virtual memory to which the first portion of the data in the journal area of memory pertains.

3. The method according to claim 1, wherein the second portion of data is stored in main memory of the computer system.

4. The method according to claim 1, wherein the second portion of data is stored on a mass storage device of the computer system.

5. The method according to claim 1, wherein the second portion of data consists of the data in the virtual memory that immediately follows the data in the virtual memory to which the first portion of the data in the journal area of memory pertains.

6. The method according to claim 1, wherein the second portion of data is stored in a file on a disk of the computer system.

7. The method according to claim 1, wherein the journal area of memory is used exclusively for storing data output by a journaling system.

8. The method according to claim 1, wherein the virtual memory includes a persistent storage device.

9. The method according to claim 1, further comprising the step of:

after the scanning step, writing the changes embodied in the first portion of the data in the journal area of memory to the virtual memory of the computer system only if no viruses are detected in the scanning step.

10. A system comprising:

a processor;

a memory coupled to the processor and readable by the processor, the memory including virtual memory and a journal storage area, data being stored in the journal storage area before changes embodied in the data are written to the virtual memory of the system; and

a virus scanner controlled by the processor, the virus scanner scanning a journal entry in the journal storage area and a portion of data in the virtual memory of the system for viruses, the portion of data comprising data in the virtual memory that immediately precedes and/or immediately follows data in the virtual memory to which the journal entry in the journal storage area pertains.

11. The system according to claim 10, wherein the portion of data consists of the data in the virtual memory that immediately precedes the data in the virtual memory to which the journal entry in the journal storage area pertains.

12. The system according to claim 10, wherein the portion of data is stored in a main memory portion of the virtual memory.

13. The system according to claim 10, wherein the portion of data is stored on a mass storage device portion of the virtual memory.

14. The system according to claim 10, wherein the portion of data consists of the data in the virtual memory that immediately follows the data in the virtual memory to which the journal entry in the journal storage area pertains.

15. The system according to claim 10, wherein the portion of data is stored in a file on a disk of the system.

16. The system according to claim 10, wherein the virtual memory includes a persistent storage device.

17. The system according to claim 10, wherein, after the scanning by the virus scanner, the processor writes the changes embodied in the journal entry to the virtual memory of the system only if no viruses are detected in the scanning by the virus scanner.

18. A computer-readable medium encoded with a program for detecting viruses on a computer system, the computer system including a virtual memory and a journal area of memory, the program comprising instructions for performing the steps of:

storing data in the journal area of memory before changes embodied in the data are written to the virtual memory of the computer system; and

scanning, by a processor, a first portion of the data in the journal area of memory and a second portion of data in the virtual memory of the computer system for viruses, the second portion of data comprising data in the virtual memory that immediately precedes and/or immediately follows data in the virtual memory to which the first portion of the data in the journal area of memory pertains.

19. The computer-readable medium according to claim 18, wherein the second portion of data is stored on a mass storage device of the computer system.

20. The computer-readable medium according to claim 18, wherein the program further comprises instructions for performing the step of:

after the scanning step, writing the changes embodied in the first portion of the data in the journal area of memory to the virtual memory of the computer system only if no viruses are detected in the scanning step.