Malware detection and content item recovery

1. A method comprising:

receiving, at a content management system from a client device, a change set including change entries describing changes to content contained in content items at the client device, wherein the content items comprise document files and wherein the content management system is configured to apply the described changes to original versions of respective content items;

storing, by the content management system, the received change set in a repository of change sets;

comparing, by the content management system, each change entry in the change set to one or more malware detection rules;

determining, by the content management system, that a threshold number of the change entries in the change set satisfies at least one of the one or more malware detection rules;

in response to determining that the threshold number of the change entries satisfies at least one of the one or more malware detection rules, determining, by the content management system, that the client device likely has malicious software; and

initiating a full scan of the stored change sets associated with the client device to confirm that the client device has the malicious software.

2. The method of claim 1 , further comprising:

automatically confirming, by the content management system, that the client device has the malicious software during the full scan of the stored change sets associated with the client device;

sending a notification to the client device indicating that the client device is infected with the malicious software;

receiving, by the content management system, instructions to suspend synchronization of content items between the content management system and the client device; and

in response to receiving the instructions, suspending synchronization of the content items between the content management system and the client device.

3. The method of claim 1 , further comprising:

automatically determining, by the content management system, content items affected by the malicious software.

4. The method of claim 3 , further comprising:

automatically determining, by the content management system, a start time corresponding to a first change entry associated with the malicious software; and

restoring, by the content management system, a previous version of each content item affected by the malicious software, the previous version corresponding to a latest version of the corresponding content item that existed immediately before the start time.

5. The method of claim 4 , wherein restoring the previous version of each content item affected by the malicious software includes:

automatically restoring, by the content management system, the previous version of each content item affected by the malicious software, the previous version corresponding to the latest version of the corresponding content item that existed immediately before the start time.

6. The method of claim 2 , further comprising:

receiving, by the content management system, a message from the client device indicating that the malicious software is removed from the client device; and

in response to receiving the message, resuming synchronization of the content items between the content management system and the client device.

7. The method of claim 1 , further comprising:

sending, by the content management system, a first message indicating that the client device is infected with the malicious software;

receiving, by the content management system, a second message indicating that the content management system should restore content items affected by the malicious software; and

restoring, by the content management system, a previous version of each content item affected by the malicious software, the previous version corresponding to a latest version of the corresponding content item that existed immediately before a start time corresponding to a first change entry associated with the malicious software.

8. A non-transitory computer readable medium including one or more sequences of instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving, at a content management system from a client device, a change set including change entries describing changes to content contained in content items at the client device, where the client device is associated with a first user in a team of users of the content management system, wherein the content items comprise document files and wherein the content management system is configured to apply the described changes to original versions of respective content items;

storing, by the content management system, the received change set in a repository of change sets;

comparing, by the content management system, each change entry in the change set to one or more malware detection rules, where the comparing is performed by a plurality of rule handlers, including a first rule handler for comparing each change set entry to a first malware detection rule and a second rule handler for comparing each change set entry to a second malware detection rule that is different than the first malware detection rule;

determining, by the content management system, that a threshold number of the change entries in the change set satisfies at least one of the one or more malware detection rules;

in response to determining that the threshold number of the change entries satisfies at least one of the one or more malware detection rules, determining, by the content management system, that the client device likely has malicious software; and

initiating a full scan of the stored change sets associated with the client device to confirm that the client device has the malicious software.

9. The non-transitory computer readable medium of claim 8 , where the instructions cause the processors to perform operations comprising:

automatically confirming, by the content management system, that the client device has the malicious software during the full scan of the stored change sets associated with the client device; and

in response to confirming that the client device has the malicious software, sending a message to the first user and an administrator user for the team of users indicating that the client device has the malicious software;

receiving a second message indicating that the administrator user wishes to suspend synchronization of content items between the content management system and the client device; and

in response to receiving the second message, suspending synchronization of content items between the content management system and the client device.

10. The non-transitory computer readable medium of claim 8 , where the instructions cause the processors to perform operations comprising:

automatically determining, by the content management system, content items affected by the malicious software.

11. The non-transitory computer readable medium of claim 10 , where the instructions cause the processors to perform operations comprising:

automatically determining, by the content management system, a start time corresponding to a first change entry associated with the malicious software; and

restoring, by the content management system, a previous version of each content item affected by the malicious software, the previous version corresponding to a latest version of the corresponding content item that existed immediately before the start time.

12. The non-transitory computer readable medium of claim 11 , wherein the restoring is performed in response to receiving a request from an administrator user of the team of content management system users to restore the previous version of each content item affected by the malicious software.

13. The non-transitory computer readable medium of claim 9 , where the instructions cause the processors to perform operations comprising:

receiving, by the content management system, a further message from the administrator user indicating that the malicious software is removed from the client device; and

in response to receiving the further message, resuming synchronization of the content items between the content management system and the client device.

14. The non-transitory computer readable medium of claim 8 , where the instructions cause the processors to perform operations comprising:

sending, by the content management system, a first message indicating that the client device is infected with the malicious software;

receiving, by the content management system, a second message indicating that an administrator user of the team of users of the content management system wishes to restore content items affected by the malicious software; and

restoring, by the content management system, a previous version of each content item affected by the malicious software, the previous version corresponding to a latest version of the corresponding content item that existed immediately before a start time corresponding to a first change entry associated with the malicious software.

15. A content management system comprising:

one or more processors; and

a non-transitory computer readable medium including one or more sequences of instructions that, when executed by the one or more processors, cause the processors to perform operations comprising:

receiving, at the content management system from a client device, a change set including change entries describing changes to content contained in content items synchronized with a user account on the content management system, wherein the content items comprise document files and the content management system is configured to apply the described changes to original versions of respective content items, and wherein the client device is authorized on the user account, the change set independent from the content items;

storing, by the content management system, the received change set in a repository of change sets;

comparing, by the content management system, each change entry in the change set to one or more malware detection rules;

determining, by the content management system, that a threshold number of the change entries in the change set satisfies at least one of the malware detection rules;

in response to determining that the threshold number of the change entries satisfies at least one of the malware detection rules, determining, by the content management system, that the client device likely has malicious software.

16. The content management system of claim 15 , where the instructions cause the one or more processors to perform operations comprising:

automatically confirming, by the content management system, that the client device has malicious software during a full scan of the stored change sets associated with the client device; and

in response to confirming that the client device has the malicious software, automatically suspending synchronization of the content items between the content management system and the client device.

17. The content management system of claim 15 , where the instructions cause the one or more processors to perform operations comprising:

automatically determining, by the content management system, content items affected by the malicious software.

18. The content management system of claim 17 , where the instructions cause the processors to one or more perform operations comprising:

automatically determining, by the content management system, a start time corresponding to a first change entry associated with the malicious software; and

restoring, by the content management system, a previous version of each content item affected by the malicious software, the previous version corresponding to a latest version of the corresponding content item that existed immediately before the start time.

19. The content management system of claim 18 , where the instructions cause the one or more processors to perform operations comprising:

in response to determining that the client device likely has the malicious software, initiating a full scan of the stored change sets associated with the client device to confirm that the client device has the malicious software.

20. The content management system of claim 16 , where the instructions cause the one or more processors to perform operations comprising:

receiving, by the content management system, a message associated with the user account indicating that the malicious software is removed from the client device; and

in response to receiving the message, resuming synchronization of the content items between the content management system and the client device.

21. The content management system of claim 15 , where the instructions cause the one or more processors to perform operations comprising:

sending, by the content management system, a first message to the client device indicating that the client device is infected with the malicious software;

receiving, by the content management system, a second message indicating that a user of the client device wishes to restore content items affected by the malicious software; and

restoring, by the content management system, a previous version of each content item affected by the malicious software, the previous version corresponding to a latest version of the corresponding content item that existed immediately before a start time corresponding to a first change entry associated with the malicious software.