US5889943A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Apparatus and method for electronic mail virus detection and elimination
Assignee: Trend Micro Inc
•
Filing: 1996-03-29
•
Granted: 1999-03-30
•
Expires: 2016-03-29
Abstract
Abstract The detection and elimination of viruses on a computer network is disclosed. An apparatus for detecting and eliminating viruses which may be introduced by messages sent through a postal node of a network electronic mail system includes polling and retrieval modules in communication with the postal node to determine the presence of unscanned messages and to download data associated with them to a node for treatment by a virus analysis and treatment module. A method for detecting and eliminating viruses introduced by an electronic mail system includes polling the postal node for unscanned messages, downloading the messages into a memory of a node, and performing virus detection and analysis at the node.
Inventors
- 👤 Shuang Ji
- 👤 Eva Chen
- 👤 Yung-Chang Liang
- 👤 Warren Tsai
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-02 22:10
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/564; H; H04; H04L; H04L51/00; H04L51/21; H04L51/212; H04L63/00; H04L63/14; H04L63/1441; H04L63/145; H04L9/00; H04L9/40; H04L51/06; H04L51/063
Claims Analysis
Total Claims: 45
Claim 1
Independent Claim
53 words
An apparatus for detecting and selectively removing viruses in messages transferred using an electronic mail system, the apparatus comprising: a message detecting module, for detecting the presence of a message; and a virus analyzing module, in communication with the message detecting module, for determining whether data associated with the message contains a virus.
Claim 2
Independent Claim
53 words
An apparatus for detecting and selectively removing viruses in messages transferred using an electronic mail system, the apparatus comprising: a message detecting module, for detecting the presence of a message; and a virus analyzing module, in communication with the message detecting module, for determining whether data associated with the message contains a virus.
Claim 3
Dependent Claim
44 words
The apparatus of claim 1, further comprising: a retrieval module, in communication with the message detecting module and the virus analyzing module, for obtaining a copy of the data associated with the message and providing the copy of data to the virus analyzing module.
Claim 4
Dependent Claim
26 words
The apparatus of claim 2, further comprising: a virus treatment module, in communication with the virus analyzing module, for treating messages found to contain a virus.
Claim 5
Dependent Claim
51 words
The apparatus of claim 3, wherein the message is intended for access by a first node; the message detecting module, the retrieval module, the virus analyzing module, and the virus treatment module reside at the first node; and the message detected by the message detecting module resides at a second node.
Claim 6
Dependent Claim
18 words
The apparatus of claim 4, wherein the second node is a postal node in the electronic mail system.
Claim 7
Dependent Claim
24 words
The apparatus of claim 5, wherein the virus treatment module includes routines for replacing the attachment at the postal node with a cleaned attachment.
Claim 8
Dependent Claim
20 words
The apparatus of claim 1, wherein the message detecting module accesses a mailbox file in the detection of the message.
Claim 9
Dependent Claim
19 words
The apparatus of claim 7, wherein the message detecting module emulates polling routines used by the electronic mail system.
Claim 10
Dependent Claim
20 words
The apparatus of claim 4, wherein the message comprises a unique message identifier, a header, and at least one attachment.
Claim 11
Dependent Claim
54 words
The apparatus of claim 9, further comprising: a data buffer, in communication with the retrieval module, for keeping a record associated with the message, the record including a first field for storing an indication of the unique message identifier and a second field for storing an indication of whether the message has been analyzed.
Claim 12
Dependent Claim
28 words
The apparatus of claim 9, wherein the virus treatment module includes routines for performing a preset action on the message when a virus is detected in the message.
Claim 13
Dependent Claim
55 words
The apparatus of claim 11, wherein the preset action performed by the virus treatment module comprises at least one of: allowing message access by the first node without changing the message, preventing message access by the first node, notifying a party regarding the presence of the virus, and modifying the message to remove the virus.
Claim 14
Dependent Claim
39 words
The apparatus of claim 12, wherein the message modification performed by the virus treatment module to remove the virus comprises at least one of: cleaning portions of the attachment, deleting the attachment, and stripping infected portions from the attachment.
Claim 15
Dependent Claim
52 words
The apparatus of claim 3, wherein the message is intended for access by a first node, the message detecting module and the virus treatment module reside at a server; and the virus treatment module includes routines for performing a preset action on the message when a virus is detected in the message.
Claim 16
Dependent Claim
55 words
The apparatus of claim 14, wherein the preset action performed by the virus treatment module comprises at least one of: allowing message access by the first node without changing the message, preventing message access by the first node, notifying a party regarding the presence of the virus, and modifying the message to remove the virus.
Claim 17
Dependent Claim
42 words
The apparatus of claim 15, wherein the message modification performed by the virus treatment module to remove the virus comprises at least one of: cleaning portions of an attachment to the message, deleting the attachment, and stripping infected portions from the attachment.
Claim 18
Independent Claim
40 words
A method for detecting and selectively removing viruses in messages transferred using an electronic mail system, the method comprising: detecting the presence of a message; and analyzing the message to determine whether data associated with the message contains a virus.
Claim 19
Independent Claim
40 words
A method for detecting and selectively removing viruses in messages transferred using an electronic mail system, the method comprising: detecting the presence of a message; and analyzing the message to determine whether data associated with the message contains a virus.
Claim 20
Dependent Claim
29 words
The method of claim 17, further comprising the steps of obtaining a copy of the data associated with the mail message and providing the copy of data for analysis.
Claim 21
Dependent Claim
14 words
The method of claim 18, further comprising: treating messages found to contain a virus.
Claim 22
Dependent Claim
46 words
The method of claim 19, wherein the message is intended for access by a first node; the steps of detecting the presence of a message and analyzing the message are undertaken at the first node; and the message that is detected resides at a second node.
Claim 23
Dependent Claim
18 words
The method of claim 20, wherein the second node is a postal node in the electronic mail system.
Claim 24
Dependent Claim
30 words
The method of claim 21, wherein the step of treating the message comprises: replacing an attachment at the postal node with a cleaned attachment, the attachment corresponding to the message.
Claim 25
Dependent Claim
20 words
The method of claim 17, wherein the step of detecting the presence of a message comprises accessing a mailbox file.
Claim 26
Dependent Claim
26 words
The method of claim 23, wherein the step of detecting the presence of a message comprises emulating the polling routines used by the electronic mail system.
Claim 27
Dependent Claim
20 words
The method of claim 20, wherein the message comprises a unique message identifier, a header, and at least one attachment.
Claim 28
Dependent Claim
24 words
The method of claim 25, further comprising: recording the unique message identifier in a data buffer to log whether the message has been analyzed.
Claim 29
Dependent Claim
28 words
The method of claim 25, wherein the step of treating the message comprises performing a preset action on the message when a virus is detected in the message.
Claim 30
Dependent Claim
56 words
The method of claim 27, wherein the step of performing a preset action comprises at least one of the steps of: allowing message access by the first node without changing the message, preventing message access by the first node, notifying a party regarding the presence of the virus, and modifying the message to remove the virus.
Claim 31
Dependent Claim
39 words
The method of claim 28, wherein the step of modifying the message to remove the virus comprises at least one of the steps of: cleaning portions of the attachment, deleting the attachment, and stripping infected portions from the attachment.
Claim 32
Dependent Claim
53 words
The method of claim 19, wherein the message is intended for access by a first node, the step of detecting the presence of a message is undertaken at a server; and the step of treating the message comprises performing a preset action on the message when a virus is detected in the message.
Claim 33
Dependent Claim
56 words
The method of claim 30, wherein the step of performing a preset action comprises at least one of the steps of: allowing message access by the first node without changing the message, preventing message access by the first node, notifying a party regarding the presence of the virus, and modifying the message to remove the virus.
Claim 34
Dependent Claim
39 words
The method of claim 31, wherein the step of modifying the message to remove the virus comprises at least one of the steps of: cleaning portions of the attachment, deleting the attachment, and stripping infected portions from the attachment.
Claim 35
Independent Claim
43 words
An apparatus for detecting and selectively removing viruses in messages transferred using an electronic mail system, the apparatus comprising: means for detecting the presence of a message; means for analyzing the message to determine whether data associated with the message contains a virus.
Claim 36
Independent Claim
43 words
An apparatus for detecting and selectively removing viruses in messages transferred using an electronic mail system, the apparatus comprising: means for detecting the presence of a message; means for analyzing the message to determine whether data associated with the message contains a virus.
Claim 37
Dependent Claim
20 words
The apparatus of claim 33, further comprising: means for obtaining a copy of the data associated with the mail message.
Claim 38
Dependent Claim
21 words
The apparatus of claim 34, further comprising: means for treating the message when the message is determined to contain a virus.
Claim 39
Dependent Claim
41 words
The apparatus of claim 35, wherein the message is intended for access by a first node; the means for detecting the presence of a message resides at the first node; and the message that is detected resides at a second node.
Claim 40
Dependent Claim
18 words
The apparatus of claim 36, wherein the second node is a postal node in the electronic mail system.
Claim 41
Dependent Claim
32 words
The apparatus of claim 37, wherein the means for treating the message comprises: means for replacing an attachment at the postal node with a cleaned attachment, the attachment corresponding to the message.
Claim 42
Dependent Claim
22 words
The apparatus of claim 33, wherein the means for detecting the presence of a message comprises means for accessing a mailbox file.
Claim 43
Dependent Claim
25 words
The apparatus of claim 39, wherein the means for detecting the presence of a message emulates the polling routines used by the electronic mail system.
Claim 44
Dependent Claim
20 words
The apparatus of claim 36, wherein the message comprises a unique message identifier, a header, and at least one attachment.
Claim 45
Dependent Claim
26 words
The apparatus of claim 41, further comprising: means for recording the unique message identifier in a data buffer to log whether the message has been analyzed.
References Cited (Backward Citations)
US5321840A
Cited
US4975950A
Cited
US5319776A
Cited
US5511163A
Cited
WO1993022723A1
Cited
US5278901A
Cited
US5428795A
Cited
US5550976A
Cited
US5440723A
Cited
US5452442A
Cited
JPH06350784A
Cited
US5448668A
Cited
US5444850A
Cited
US5414833A
Cited
US5530757A
Cited
US5485575A
Cited
US5550984A
Cited
US5491791A
Cited
US5623600A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-03-29 | 2002-09-28 | 2003-03-30 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-03-29 | 2006-09-28 | 2007-03-30 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-03-29 | 2010-09-28 | 2011-03-30 | $7700.00 | Window Closed / Lapsed |