[54] METHOD AND APPARATUS FOR PROTECTING DATA FILES ON A COMPUTER FROM VIRUS INFECTION
[75] Inventors: James E. Walsh, Kirkland; Ebbe H. A.
Altberg, Bellevue, both of Wash.
[73] Assignee: Microsoft Corporation, Redmond, Wash.
[21] Appl. No.: 08/797,485 [22] Filed: Feb. 6, 1997
[51] Int. CI. G06F 12/16
[52] U.S. CI 395/186; 380/4
[58] Field of Search 395/183.14, 183.15,
395/183.12, 186, 682, 680; 364/580; 380/4
[56] References Cited
U.S. PATENT DOCUMENTS
5,257,381 10/1993 Cook 395/682
5,398,196 3/1995 Chambers 364/580
5,684,875 11/1997 Ellenberger 380/4
OTHER PUBLICATIONS
Leach, Norvin, "Utility vendors zero in on Word macro virus (McAfee Associates Inc's VirusScan, Symantec Corp's Norton Anti-Virus anti-virus software)," PC Week, vol. 12, No. 42, p. 6(1), Oct. 23, 1995.
Leach, Norvin, "Utility vendors scramble to thwart MS Word virus (a Microsoft Word 'macro virus' called WinWord.Concept)," PC Week, vol. 12, No. 35, p. 10(1), Sep. 4, 1995.
Protection of data files on a computer system from infection or damage by a computer virus. A virus protection system can detect either an external or internal open file event for a file maintained on a local or remote computer. Typically, the protection system is implemented as an internal component of the program module that processes the files protected by the protection system. Prior to responding to a detected open file event, an inquiry is conducted to determine whether the file is likely to contain a virus. If so, a notice is generated to indicate that the file may contain a virus, thereby advising of the possible danger of spreading the virus to other files if the file opening is completed. If the file is not likely to contain the virus, the response to the detected open file event is completed by opening the file for processing by the program module.
34 Claims, 5 Drawing Sheets
