Abstract: The invention provides an antivirus network or Internet appliance and methods therefor. A preferred embodiment of the Internet appliance according to the invention comprises an interface connecting the Internet appliance to a terminal, a memory, and a network connection connecting the Internet appliance to a network (such as a wide area network (WAN) or the Internet) wherein data in the network are operable with a corresponding network protocol (such as TCP/IP). Protocol-level programs are stored in the memory for receiving data being transmitted from the network to the terminal through the Internet appliance wherein the protocol-level programs are compatibly operable with the network protocol. Application-level antivirus programs are stored in the memory for detecting computer viruses in the received data serving as a firewall against the detected computer viruses for the terminal.

Abstract: A system identifies computer worms associated with published, or otherwise, known security holes. The system uses a worm pattern developed to identify those data packets most likely to be a computer worm designed to take advantage of a particular security hole. The worm pattern includes a portion used to functionally characterize the computer worm and another portion used to provide a defense mechanism used to thwart the worm attack. In some cases, the defense action is truncating the suspected data word, while in other cases, the suspect data word is stored in a buffer for later investigation. In a particular implementation, the worm patterns are retrieved from a worm pattern update server.

Abstract: The invention generally provides an antivirus network system and method for handling electronic mails (e-mails) infected by computer viruses in a network having a plurality of device nodes receiving and transmitting e-mails through a gateway server. A preferred embodiment of the method according to the invention primarily comprises the steps of determining if any of the e-mails are infected by computer viruses, attaching flags to the infected e-mails, transporting the e-mails, including the infected e-mails, through the gateway server, identifying the infected e-mails through the attached flags, and performing antivirus actions on the identified e-mails, where these process steps are performed transparently to the plurality of device nodes. The method according to the invention can further include the step of processing the infected e-mails according to instructions in the attached flags, where the instructions further include deleting, blocking and quarantining the infected e-mails.

Abstract: The invention provides an antivirus network or Internet appliance and methods therefor. A preferred embodiment of the Internet appliance according to the invention comprises an interface connecting the Internet appliance to a terminal, a memory, and a network connection connecting the Internet appliance to a network (such as a wide area network (WAN) or the Internet) wherein data in the network are operable with a corresponding network protocol (such as TCP/IP). Protocol-level programs are stored in the memory for receiving data being transmitted from the network to the terminal through the Internet appliance wherein the protocol-level programs are compatibly operable with the network protocol. Application-level antivirus programs are stored in the memory for detecting computer viruses in the received data serving as a firewall against the detected computer viruses for the terminal.