Abstract: In a first embodiment, in a distributed network having a number of server computers and associated client devices, method of enforcing an anti-virus security policy is described. The method is carried out by querying each of the client devices to determine if each of the client devices has an appropriate anti-virus software installed, identifying those queried client devices not having the appropriate anti-virus software as target client devices, locking all communications channels of the target client devices to a anti-virus software installation server, and installing the appropriate anti-virus software to all target client devices.

Abstract: A network level virus monitoring system capable of monitoring a flow of network traffic in any of a number of inspection modes depending upon the particular needs of a system administrator. The system includes a network virus sensor self registration module coupled to a network virus/worm sensor arranged to automatically self register the associated network virus/worm sensor. The monitoring provides an early warning of a virus attack thereby facilitating quarantine procedures directed at containing a virus outbreak. By providing such an early warning, the network virus monitor reduces the number of computers ultimately affected by the virus attack resulting in a concomitant reduction in both the cost of repair to the system and the amount of downtime. In this way, the inventive network virus monitor provides a great improvement in system uptime and reduction in system losses.

Abstract: In a distributed network having a number of server computers and associated client devices, method of isolating infected client devices from uninfected client devices is described. The method is carried out by correlating network related virus infection information, determining if a virus outbreak has occurred based on the correlated information, isolating infected client devices from uninfected client devices when the virus outbreak is confirmed, monitoring all data packets in the network for the virus, identifying a packet type associated with the virus, and blocking only the identified packet type.

Abstract: In a distributed network having a number of server computers and associated client devices, method of creating an anti-computer virus agent is described. As a method, the innoculation is carried out by parsing a selected computer virus into a detection module that identifies a selected one of the client devices as a target client device, an infection module that causes the virus to infect those target client devices not infected by the selected virus, and a viral code payload module that infects the targeted client device modifying the infection module to infect those computers already infected by the selected virus; and incorporating innoculation viral code in the payload module that acts to prevent further infection by the selected virus.

Abstract: A network level virus monitoring system capable of monitoring a flow of network traffic in any of a number of inspection modes depending upon the particular needs of a system administrator. The system includes a network virus sensor self registration module coupled to a network virus/worm sensor arranged to automatically self register the associated network virus/worm sensor. The monitoring provides an early warning of a virus attack thereby facilitating quarantine procedures directed at containing a virus outbreak. By providing such an early warning, the network virus monitor reduces the number of computers ultimately affected by the virus attack resulting in a concomitant reduction in both the cost of repair to the system and the amount of downtime. In this way, the inventive network virus monitor provides a great improvement in system uptime and reduction in system losses.

Abstract: A system identifies computer worms associated with published, or otherwise, known security holes. The system uses a worm pattern developed to identify those data packets most likely to be a computer worm designed to take advantage of a particular security hole. The worm pattern includes a portion used to functionally characterize the computer worm and another portion used to provide a defense mechanism used to thwart the worm attack. In some cases, the defense action is truncating the suspected data word, while in other cases, the suspect data word is stored in a buffer for later investigation. In a particular implementation, the worm patterns are retrieved from a worm pattern update server.