Virus detection in a network
View Patent ↗A computer system and storage medium that in an embodiment count the number of times that a file or registry entry is added, changed, or deleted at clients in a network. If the count exceeds a threshold, then a warning is sent to the clients. The warning may prompt the clients to delete or rename the file or registry entry, run an anti-virus program, quarantine the file or registry entry, or issue a message. In this way, viruses may be detected at clients.
1. A non-transitory computer-readable storage medium encoded with instructions, wherein the instructions when executed on a processor comprise:
receiving a plurality of notifications from a plurality of clients in network, wherein each of the plurality of clients detected that an attribute of a file was changed, and wherein each of the plurality of notifications comprises a name of the file, a modifying entity, and the attribute of the file, wherein the modifying entity identifies a program that changed the attribute of the file; saving the plurality of notifications to a computer; determining a count of a number of times that the notifications that the attribute of the file was changed were received; selecting a threshold, wherein the selecting the threshold further comprises selecting the threshold that is higher if the modifying entity is trusted by a system administrator and selecting the threshold that is lower if the modifying entity is not trusted by the system administrator; and deciding whether the file includes a suspected virus if the count exceeds the threshold.
2. The non-transitory computer-readable storage medium of claim 1 , further comprising: if the deciding is true, sending a warning to the plurality of clients; and if the deciding is false, refraining from sending the warning to the plurality of clients.
3. The non-transitory computer-readable storage medium of claim 1 , wherein the attribute comprises a size of the file.
4. The non-transitory computer-readable storage medium of claim 1 , wherein the attribute comprises a certificate of authenticity.
5. The non-transitory computer-readable storage medium of claim 1 , wherein the attribute comprises an extension of the file.
6. The non-transitory computer-readable storage medium of claim 2 , wherein the file comprises a registry entry.
7. The non-transitory computer-readable storage medium of claim 6 , wherein the warning comprises an instruction to delete the registry entry.
8. The non-transitory computer-readable storage medium of claim 2 , wherein the warning comprises an instruction to execute an anti-virus program.
9. The non-transitory computer-readable storage medium of claim 2 , wherein the warning comprises an instruction to display a message.
10. The non-transitory computer-readable storage medium of claim 1 , wherein the selecting the threshold further comprises selecting the threshold that is higher if the modifying entity is trusted by the system administrator to not introduce the suspected virus.
11. A computer system comprising:
a processor; and
memory connected to the processor, wherein the memory is encoded with instructions, wherein the instructions when executed on the processor comprise:
receiving a plurality of notifications from a plurality of clients in network, wherein each of the plurality of clients detected that an attribute of a file was changed, and wherein each of the plurality of notifications comprises a name of the file, a modifying entity, and the attribute of the file, wherein the modifying entity identifies a program that changed the attribute of the file,
determining a count of a number of times that the notifications that the attribute of the file was changed were received,
selecting a threshold, wherein the selecting the threshold further comprises selecting the threshold that is higher if the modifying entity is trusted by a system administrator and selecting the threshold that is lower if the modifying entity is not trusted by the system administrator, and
deciding whether the file includes a suspected virus if the count exceeds the threshold.
12. The computer system of claim 11 , wherein the instructions further comprise:
if the deciding is true, sending a warning to the plurality of clients; and
if the deciding is false, refraining from sending the warning to the plurality of clients.
13. The computer system of claim 11 , wherein the attribute comprises a size of the file.
14. The computer system of claim 11 , wherein the attribute comprises a certificate of authenticity.
15. The computer system of claim 11 , wherein the attribute comprises an extension of the file.
16. The computer system of claim 12 , wherein the file comprises a registry entry.
17. The computer system of claim 16 , wherein the warning comprises an instruction to delete the registry entry.
18. The computer system of claim 12 , wherein the warning comprises an instruction to execute an anti-virus program.
19. The computer system of claim 12 , wherein the warning comprises an instruction to display a message.
20. The computer system of claim 11 , wherein the selecting the threshold further comprises selecting the threshold that is higher if the modifying entity is trusted by the system administrator to not introduce the suspected virus.