SYSTEM AND METHOD FOR HANDLING FILES INCOMING TO A COMPUTER

PRIORITY

[0001] This application claims priority benefit of U.S. Provisional Patent Application No. 60/702,310 entitled "SYSTEM AND METHOD FOR HANDLING FILES INCOMING TO A COMPUTER," filed July 25, 2005, the disclosure of which is hereby incorporated herein by reference and of U.S. Utility Patent Application No. 11/271,371 entitled "SYSTEM AND METHOD FOR HANDLING FILES INCOMING TO A COMPUTER," filed November 10, 2005, the disclosure of which is hereby incorporated herein by reference.

SYSTEM AND METHOD FOR HANDLING FILES INCOMING TO A COMPUTER

FIELD OF THE INVENTION

[0002] This invention relates to processing of files incoming to a computer system and more particularly to systems and methods for reducing the risk of contamination of the system from files containing damaging data.

BACKGROUND OF THE INVENTION

[0003] Certain computer operating systems, such as, for example, the well- know Windows® operating system from Microsoft, allow a user to simply "click" on a filename to open or execute the file. In the Windows system, as in other systems, each file has a name identifying the file. Following the name proper (usually separated by a period ".") there are "extensions" that denote, both to the user and to the system certain attributes of the file. One such attribute is the application that created the file (such as a particular word processing application or a particular spreadsheet) another such attribute is the file type (such as compression). One such extension of several possible extensions is the EXE extension which marks the file as an executable file to a Windows operating system. This means that the file contains data designed in a manner to provide instructions to the operating system that the operating system uses to effect changes to system operation, as opposed to merely running within a single defined pre-established application. Such a file is a computer program as opposed to a data file such as a word processing document. Other file extensions that operate beyond a specific application include .pif, .scr, .com.

[0004] If the user clicks on an executable file, the file will open and run the instructions contained therein. Thus, if an executable file contains malicious material, such as a virus, it is possible to "infect" the entire computer system in ways detrimental not only to the computer system on which the virus resides, but to other computer systems networked thereto or in communication therewith. Thus, preventing a computer system from becoming infected with a virus, or other malicious data, is economically desirable.

[0005] Compounding the problem is the fact that in many situations the default display mode of the computer system is to remove the last file extension in a filename from view. Thus, if a filename is displayed as "letter to mom" its full filename could be "letter to mom.doc". The ".doc" would be suppressed. Accordingly, a file named, "happy time" could, in reality, actually be named "happy time.exe". If that file contained malicious code and an unsuspecting user opened the file thinking it was, for example, a note from a trusted friend, the user could be in for a nasty surprise. Since the nature of malicious code is to be subversive, often the user does not even know until a

file is opened that his/her computer system has become infected. At that point, it is too late to prevent damage.

[0006] In some instances, the full filename of the file "happy time" could have been "happy time.doc.exe". In such a situation, the ".exe" would have been removed from view, (hidden) and the filename would appear to the user as "happy time.doc" thereby encouraging even a savvy user (i.e., a user who recognizes that a ".exe" extension is potentially a problem) to open it.

[0007] There are many methods for files to enter a computer system. One such method is via email which arrives at a computer system carrying with it an "attachment" in the form of one or more files having names as discussed above. Another such method is the arrival at a computer system (via email, disk, etc.) of a compressed set of files (zip, gzip, etc.) which, when uncompressed, contain files having malicious data within them. To the unwary, and often even to those who are trained, such files are a source of trouble when opened. To further compound the problem, some files are designed to be self-opening when placed on a system. Thus, when a file is "unzipped" it can be infected and if it has a certain filename extension could be opened to the detriment of the user's system. It is possible for some file types that normally run within a single defined pre-established application, such as .doc files, to harbor macro viruses that can damage the computer system in much the same way as do programs.

BRIEF SUMMARY OF THE INVENTION

[0008] Advantage is taken in the fact that the files that operate beyond a single application, for example, (executable files) are files having extensions which are already known to the system and which extensions must be appended to a filename in the last position of the filename, hi one embodiment, when a file is incoming to a computer system the executable nature of the file is temporarily inhibited by modifying the last extension. This modification can be by appending a new "safe" extension to the end of the filename, which appended extension must be removed before the file will execute. The safe extension could, if desired, convey information to the user about the nature of the file.

[0009] hi one embodiment, files containing potentially troubling data are identified to the user. In another embodiment, the user must acknowledge his/her desire to open an executable file.

BRIEF DESCRIPTION OF THE DRAWINGS

[0010] For a more complete understanding of the present invention, reference is now made to the following descriptions taken in conjunction with the accompanying drawings, in which:

[0011] FIGURE 1 shows one embodiment of a flow chart for processing files incoming to a computer;

[0012] FIGURE 2 shows one embodiment of a flow chart for processing the opening of files on a computer system;

[0013] FIGURE 3 shows one embodiment of a computer system upon which the processes of FIGURES 1 and 2 can be run; and

[0014] FIGURES 4A and 4B show embodiments of displays for alerting a user to executable files.

DETAILED DESCRIPTION OF THE INVENTION

[0015] FIGURE 1 shows one embodiment 10 of a flow chart for processing files incoming to a computer. In process 101 a new file arrives at the computer system either as an email attachment, a zip file or in a program or other application. In process 101 a determination is made as to whether this is an email. If it is, then process 102 determines if there is an attachment to the email, if not then the email is delivered to the proper location for use by the user of the system. If process 101 on the other hand determines that there was no email or if process 102 determines that there is an attachment, then the file or email is looked at or unzipped if necessary and process 103 determines by an extension of the filename whether it is an executable file. If it is, then the extension is modified by process 105. This modification can be by adding a new extension, such as .saf at the end of the file extension, by removing the .exe, or by adding the original extension(s) to the filename and adding a new extension, or by moving the executable (or all) extensions to a non-executable location within said filename, or a combination thereof. Also, note that different types of files can have different modifications so that the user could observe the modification and know something about the file or something about what caused the file to be marked in the manner that it was. The modification (new file extensions) could be an indication of risk level of the file. For example, a file named mypict.jpg.exe could become mypict.jpg.exe.saf, or could become mypictexe.jpg (where the executable extension "exe" is moved within the filename proper) or could become mypict.jpg. saf. This last possibility, however removes the user's ability to properly run the file (program).

[0016] Process 103 determines that a file does not appear to be executable because of its extension name then process 104 looks for other concerns, for example, microviruses in MS WORD documents or JPEG picture files containing programs. If, for example, a JPEG picture file or a sound file contains a program hidden within the file then process 105 modifies the extension as discussed above. If process 104, on the other hand, determines that there are no concerns with respect to the nomenclature of the file name then the file is available to be delivered or stored at the proper location within the system.

[0017] FIGURE 2 shows one embodiment 20 of a flow chart for processing the opening of files on a computer system. As shown in FIGURE 2 process 201 retrieves the file having an added extension. Process 202 determines if the user is attempting to open a retrieved file, if not then the system removes from view the added last extension via process 203 and process 204 system displays the file with the next to the last extension which becomes the new last extension. Process 205 determines if the new last extension is an executable extension. If it is, then process 206 issues an alert. This alert can be a sound alert or a visual alert such as, for example, changing the color of the file name on the screen to red to signify caution in opening the file. If the user is attempting to open the retrieved file, then process 207 issues a warning to the user which could be an audio gong or a message or the color alert. If process 208 makes a determination as to whether the user has acknowledged the warning and if so opens the file via process 210 and if not does not allow the file to open process 209 until the user has acknowledged that there is a potential danger in the file since it is an executable file. Note that optionally at process 208, in addition to issuing a warning to the user, the system could have sent the file for a virus scan via process 209 and similarly with respect to process 206 in addition to issuing an alert the system could send the file to a virus scan via process 207.

[0018] FIGURE 3 shows one embodiment 30 of a computer system upon which the process of FIGURES 1 and 2 can be run. As shown in FIGURE 3, PC 33 consists of processor 302, screen 301, keyboard 303 and memory 304. PC 33 is connected to the outside world via network 31 and connection 32. Connection 32, of course, can be wireless or wireline and is available as is well known to receive information such as, for example, email with attachments. Also, files zipped or otherwise can be downloaded via communication path 32 to PC 33 as is well known.

[0019] FIGURE 4A shows screen 301 displaying an email screen with the source of the email message in the subject. Note that the email from Billie is highlighted in a color, such as blue, indicating that there could be a program masquerading as a different type of a file which has been detected because of the file name extension or because it was detected via process 104 (FIGURE 1). Also note the cousin in FIGURE 4A is shown in a different color, such as red, to indicate that the file attachment called

"camping trip" might very well be an executable file and in many cases a file which has had its extension modified for protection purposes as discussed above.

[0020] FIGURE 4B shows display 301 where file C is highlighted, such as red, to show that file C, perhaps coming from a zip drive or from an email attachment has been found to have an executable extension in its file name. Note that as discussed above, different colors can be used or different extension names can be used to indicate to the user the nature of the potential problem. Color, font style, font size, position on the screen, audible warning when the file is being opened, blinking text, a box around the text (perhaps with colored borders, are examples of attributes that can be used to identify potentially troublesome files. Note that the added extension and/or an attribute displayed to a user, can demote the severity of the potential trouble. For example, .saf and .sal could be shown as low risk while .smb. could be a high risk file.

[0021] Although the present invention and its advantages have been described in detail, it should be understood that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of the invention as defined by the appended claims. Moreover, the scope of the present application is not intended to be limited to the particular embodiments of the process, machine, manufacture, composition of matter, means, methods and steps described in the specification. As one of ordinary skill in the art will readily appreciate from the disclosure of the present invention, processes, machines, manufacture, compositions of matter, means, methods, or steps, presently existing or later to be developed that perform substantially the same function or achieve substantially the same result as the corresponding embodiments described herein may be utilized according to the present invention. Accordingly, the appended claims are intended to include within their scope such processes, machines, manufacture, compositions of matter, means, methods, or steps.