System, method and computer program product for scanning portions of data
View Patent ↗A scanning system, method and computer program product are provided. In use, portions of data are scanned. Further, access to a scanned portion of the data is allowed during scanning of another portion of the data.
1. A computer implemented method, comprising:
receiving a notification from a file system application programming interface, by an on-access scanner, of a request to access data, wherein the request to access the data is intercepted utilizing the file system application programming interface;
scanning portions of the data for unwanted code in a determined order, wherein the determined order is based on an application requesting access to the data and a file type of the data;
receiving an indication, by the on-access scanner, that a first scanned portion of the data is clean of unwanted code; and
sending, by the on-access scanner, an allow message to the file system application programming interface in response to receiving the indication, the allow message indicating that the file system application programming interface is to allow access to the first scanned portion of the data, wherein the file system application programming interface provides access to the first scanned portion of the data during scanning of a second portion of the data, and wherein the second scanned portion of the data is unlocked for access as a result of determining that the second scanned portion of the data is clean of unwanted code.
2. The method as recited in claim 1 , wherein a status of the data is identified.
3. The method as recited in claim 2 , wherein the status includes one of a known clean status and an unknown clean status.
4. The method as recited in claim 2 , wherein the status is identified based on a comparison of the data and a previously scanned version of the data.
5. The method as recited in claim 2 , wherein the data is conditionally scanned based on the status of the data.
6. The method as recited in claim 5 , wherein the data is scanned in response to the identification of an unknown clean status.
7. The method as recited in claim 1 , wherein the determined order is further based on information associated with the data.
8. The method as recited in claim 1 , wherein the determined order is further based on a pattern in which an application accesses the portions of the data.
9. The method as recited in claim 8 , wherein the application is an application requesting to access the data.
10. The method as recited in claim 1 , wherein the file system application programming interface notifies a scanner of the request to access the data.
11. The method as recited in claim 10 , wherein the notification includes information identifying the data.
12. The method as recited in claim 1 , wherein the request to access the data includes an open request.
13. The method as recited in claim 1 , wherein the request to access the data is made by an application.
14. The method as recited in claim 1 , wherein the portions of the data include at least one of a page, formatting information, content information, and a macro.
15. The method as recited in claim 1 , wherein allowing the access includes allowing at least one of a read operation, a write operation, and a seek operation to be performed on the scanned portion of the data.
16. The method as recited in claim 1 , wherein the request to access the data includes an open request issued to a file system by an application, where the open request is intercepted utilizing the file system application programming interface that notifies an on-access scanner of the open request issued to the file system by the application, and where the on-access scanner includes an interface in communication with a scanner for scanning each of the portions of the data.
17. A computer program product embodied on a non-transitory tangible computer readable medium, comprising:
computer code for receiving a notification from a file system application programming interface, by an on-access scanner, of a request to access data, wherein the request to access the data is intercepted utilizing the file system application programming interface;
computer code for scanning portions of the data for unwanted code in a determined order, wherein the determined order is based on an application requesting access to the data and a file type of the data;
computer code for receiving an indication, by the on-access scanner, that a first scanned portion of the data is clean of unwanted code; and
computer code for sending, by the on-access scanner, an allow message to the file system application programming interface in response to receiving the indication, the allow message indicating that the file system application programming interface is to allow access to the first scanned portion of the data, wherein the file system application programming interface provides access to the first scanned portion of the data during scanning of a second portion of the data, and wherein the second scanned portion of the data is unlocked for access as a result of determining that the second scanned portion of the data is clean of unwanted code.
18. A system, comprising:
a processor configured to:
receiving a notification from a file system application programming interface, by an on-access scanner, of a request to access data, wherein the request to access the data is intercepted utilizing the file system application programming interface;
scan portions of the data for unwanted code in a determined order, wherein the determined order is based on an application requesting access to the data and a file type of the data;
receive an indication, by the on-access scanner, that a first scanned portion of the data is clean of unwanted code; and
send, by the on-access scanner, an allow message to the file system application programming interface in response to receiving the indication, the allow message indicating that the file system application programming interface is to allow access to the first scanned portion of the data, wherein the file system application programming interface provides access to the first scanned portion of the data during scanning of a second portion of the data, and wherein the second scanned portion of the data is unlocked for access as a result of determining that the second scanned portion of the data is clean of unwanted code.
19. The system as recited in claim 18 , further comprising memory coupled to the processor via a bus.