Abstract:
A file policy is created for each confidential file in a server computer including a list of events and a corresponding action. The file policies for the confidential files are sent to each client computer in the computer network. A software agent on each client computer detects when an activity occurs that affects one of the confidential files having a file policy. The activity is reported to the server computer and, if the activity matches an event in the policy, the corresponding action is taken. Events include: copying a file, printing, accessing, sending via e-mail, renaming, etc. Actions include: alerting an administrator, temporary blocking the activity or preventing the activity. If the activity is temporarily blocked from occurring, the agent queries the user as to whether the user wishes to request approval, and forwards that requests on to the server computer. If the activity is approved then the software agent removes the temporary block from the user activity and allows the user's activity concerning the confidential file to occur.
Abstract:
Digits are randomly distributed into any number of a first group of sets. A type and frequency of a user input action, such as clicking a computer mouse, is associated with each set. Next, all the digits from each set are randomly distributed into a second group of sets. Each of the second group of sets may contain at most a single digit from one of the first group of sets, but may contain any number of digits total. A user input action, is also associated with each set in the second group. To input a particular digit in the password, the user selects one set of the first group of sets that contains the correct digit and selects one set of the second group of sets that also contains the same digit. Selection may occur by mouse clicking, key pressing or touching a screen. Once all digits of the password have been selected in this manner, the software determines the correct digits of the password by comparing the user selections for each digit in the password. The software outputs a result or stores the input password.
Abstract:
An on-demand cleanup application running locally removes malware and its effects from a computer system. A virus scan engine scans the computer system to identify any malicious files. A system information collector tool executes to create a log file containing detailed information about the computer system and the location of all files. Identified malicious files are matched against the log file to determine the extent of the infection by the malicious files. Computer code is generated using a blank cleanup template to automatically delete the malicious files and their effects in the computer system and placed into a final cleanup template. The cleanup template is executed by a cleanup engine in order to remove the malware and its effects from the computer. A CRC tool is used to positively identify files that are to be deleted.
Abstract:
A method for performing content analysis of a plurality of resources is provided. The method includes performing background content scanning on the plurality of resources based on a resource priority queue. The method also includes storing already scanned resources of the plurality of resources in a scan result database. The method further includes receiving a first access request asynchronously with the scanning and the storing. The method yet also includes, if the first access request pertains to a given resource not contemporaneously designated as a satisfactory scan result according to the scan result database, granting the given resource a higher priority in the resource priority queue than resources remaining to be scanned in the plurality of resources, thereby enabling the given resource to be scanned ahead of the resources remaining to be scanned.
Abstract:
A method for providing reputation information concerning a domain is disclosed. The domain may include one or more devices on a network. The method may include retrieving a first reputation pertaining to a first function of the domain. The method may also include generating a message containing information pertaining to the first reputation and at least a second reputation, wherein the second reputation pertains to a second function of the domain.
Abstract:
A subnetwork of client computers includes a designated relay host computer that communicates through a firewall with an outside server computer located within the same computing environment or over an Internet connection. A specially-designated URL on the server is used when the relay host requests that a downlink connection be kept alive indefinitely with the server computer. The server receives the HTTP request and activates a continuous heartbeat program. Heartbeat messages are sent continuously from the server computer to the relay host to keep the downlink connection open indefinitely. When the server needs to send an urgent message to the client computers it can do so immediately by using the already open downlink connection. The relay host forwards messages to the other component client computers in the subnetwork. The relay host may also use a proxy server. The downlink connection uses a standard request-reply protocol.
Abstract:
A method for providing add-on services responsive to an email transferred via a distributed computer network. The method includes receiving via the distributed computer network the email at an add-on service system. The method further includes ascertaining from the email whether a recipient of the email subscribes to at least one of the add-on services. If the recipient subscribes to the at least one of the add-on services, the method includes forming a post add-on service email, which includes performing, using the add-on service system, the at least one of the add-on services on at least a first portion of the email. Furthermore, the method includes forwarding the post add-on service email, after the performing, to the email system, thereby rendering the post add-on service email accessible to the recipient through the email system.
Abstract:
A Sever Communication Channel (“SCC”) architecture is described. The SCC architecture provides an abstract base class that describes specific service interfaces called for each service and allows handling of specific protocols for servicing the clients. Worker threads that provide services through different protocols call the specific service interfaces. One application program thereby can implement different protocols for providing diverse types of services such as, for example, scanning services.
Abstract:
A system and method for providing damage control caused by a virus epidemic in a network environment are advantageously provided according to the intention. The system according to a preferred embedment of the invention effectively and rapidly distributes antivirus protection and cure measures within the network so as to reduce the level of damage during the virus epidemic. The method according to the invention contains the spread of a computer virus in a network system by detecting the traffic flow and analyzing the identical sections in files modified in a short time period. The network system accordingly includes a management server, a management information database (MIB) having a plurality of tasks for performing work in the network system, and a plurality of device node. Each network task corresponds to an event occurring in the system. Damage control caused by a virus epidemic in a network environment is controlled and level of damage is accordingly reduced.
Abstract:
The iterative detection and treatment of viruses using virus detection objects and virus treatment objects is disclosed. Pursuant to a request for a virus scan, a virus detection object is produced by a server and is transmitted to a client for execution. The client receives and executes the virus detection object, and the results are transmitted to the server. The server uses the results to produce an additional virus detection object which is also transmitted to the client and executed so that the results can be transmitted to the server. The iterative production and execution of virus detection objects is continued until a determination is made as to whether the targeted file or data includes a virus. Upon a determination that a targeted file or data includes a virus, a vaccine specifically tailored to the conditions presented at the client and the type of virus detected is produced, preferably in the form of a virus treatment object. The request for a virus scan can be directly made or indirectly by a triggering event. One virus detection server embodiment includes a virus information expert system that applies conditional data to predetermined knowledge about virus scanning to make determinations such as when to scan for viruses. A network diagnosis and treatment application includes a diagnostic data module, an expert system, and a maintenance requesting module. The expert system applies the diagnostic data to predetermined knowledge about the diagnosis and maintenance of a network to make determinations upon which maintenance requests are made. Preferably, the expert system includes a virus information expert system.