System, method and computer program product for utilizing a threat scanner for performing non-threat-related processing

• US 8,484,725 B1
• Filed: 10/26/2005
• Issued: 07/09/2013
• Est. Priority Date: 10/26/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Telafici, Joseph V.
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US11/260,820
• Time in Patent Office: 2,813 Days
• Field of Search: 726/4, 726/5, 726/11, 726 22- 26, 713/187, 713/188, 713/189
• US Class Current: 726/22
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A threat scanning system, method and computer program product are provided. Initially, data is received or identified (e.g. by way of an update, initial installation, etc.). Such data may include first data for use in performing a first threat-related function, and second data for use in performing a second non-threat-related function. In use, the first threat-related function and the second non-threat-related function are both performed with a threat scanner, utilizing the first data and the second data.

Claims

1. A method, comprising:

receiving first data for use in performing a first threat-related function;

receiving second data separate from the first data for use in performing a second non-threat-related function;

performing the first threat-related function and the second non-threat-related function during scanning activities involving computer code provided in a computer configured for network communications, wherein the first threat-related function includes comparing threat signatures to determine whether at least one of the threat signatures matches the computer code, and wherein the second non-threat-related function includes evaluating a plurality of non-threat signatures to identify flawed code and one or more software errors; and

reacting to a threat if it is determined that at least one of the threat signatures matches the computer code, wherein the reacting includes quarantining the computer code, wherein processing of the second non-threat-related function is suspended until processing of a plurality of threat-related functions are exhausted by a threat scanner of the computer, and wherein the processing of the second non-threat-related function is disabled if a related set of non-threat-related processing was previously performed within a predetermined amount of time, and wherein an option is provided via a graphical user interface to manually disable the second non-threat-related function, wherein the second data includes a first type of file including detection data used in detecting non-threat-related computer code, a second type of file including reaction data used in reacting to a detected non-threat-related situation, and a third type of file including naming data used in naming the non-threat-related computer code in need of a non-threat-related reaction.

2. The method of claim 1, wherein the first threat-related function includes a virus scanning function.

3. The method of claim 1, wherein the first threat-related function includes a spyware scanning function.

4. The method of claim 1, wherein the reacting includes reporting the threat.

5. The method of claim 1, wherein the second non-threat-related function includes an update function.

6. The method of claim 5, wherein the update function includes updating an older version of the computer code with a newer version of the computer code.

7. The method of claim 1, wherein the second non-threat-related function includes a change to persistent system data.

8. The method of claim 1, wherein a data structure includes a tag for identifying contents thereof as being the first data or the second data.

9. The method of claim 1, wherein a data structure includes a first section for containing the first data and a second section for containing the second data.

12. The method of claim 1, wherein the second non-threat related function is disabled and enabled via a graphical user interface.

13. The method of claim 1, wherein the second data separate from the first data includes non-threat-related signatures.

10. A computer program product embodied on a tangible non-transitory computer readable medium for performing operations, comprising:

identifying first data for use in performing a first threat-related function, and second data separate from the first data for use in performing a second non-threat-related function;

performing the first threat-related function and the second non-threat-related function during scanning activities involving computer code provided in a computer configured for network communications, wherein the first threat-related function includes comparing threat signatures to determine whether at least one of the threat signatures matches the computer code, and wherein the second non-threat-related function includes evaluating a plurality of non-threat signatures to identify flawed code and one or more software errors; and

reacting to a threat if it is determined that at least one of the threat signatures matches the computer code, wherein the reacting includes quarantining the computer code, wherein processing of the second non-threat-related function is suspended until processing of a plurality of threat-related functions are exhausted by a threat scanner of the computer, and wherein the processing of the second non-threat-related function is disabled if a related set of non-threat-related processing was previously performed within a predetermined amount of time, and wherein an option is provided via a graphical user interface to manually disable the second non-threat-related function, wherein the second data includes a first type of file including detection data used in detecting non-threat-related computer code, a second type of file including reaction data used in reacting to a detected non-threat-related situation, and a third type of file including naming data used in naming the non-threat-related computer code in need of a non-threat-related reaction.

11. A computer, comprising:

a processor; and

a threat scanner, wherein the computer is configured for;

utilizing first data in performing a first threat-related function, and second data separate from the first data in performing a second non-threat-related function, wherein the first threat-related function and the second non-threat-related function are performed during scanning activities involving computer code provided in the computer configured for network communications, wherein the first threat-related function includes comparing threat signatures to determine whether at least one of the threat signatures matches the computer code, and wherein the second non-threat-related function includes evaluating a plurality of non-threat signatures to identify flawed code and one or more software errors; and

reacting to a threat if it is determined that at least one of the threat signatures matches the computer code, wherein the reacting includes quarantining the computer code, wherein processing of the second non-threat-related function is suspended until processing of a plurality of threat-related functions are exhausted by a threat scanner of the computer, and wherein the processing of the second non-threat-related function is disabled if a related set of non-threat-related processing was previously performed within a predetermined amount of time, and wherein an option is provided via a graphical user interface to manually disable the second non-threat-related function, wherein the second data includes a first type of file including detection data used in detecting non-threat-related computer code, a second type of file including reaction data used in reacting to a detected non-threat-related situation, and a third type of file including naming data used in naming the non-threat-related computer code in need of a non-threat-related reaction.