JP3871163B2 - Server transfer / editing method of virus check result and program recording medium thereof - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention is a virus capable of transferring an execution result to a server at the time of executing a virus check on the client side in a LAN environment, editing the result on the server, and grasping and managing the virus check status of the client on the server side. The present invention relates to a server transfer / editing method of check results and a recording medium storing the program.
[0002]
[Prior art]
As the range of use of personal computers (hereinafter referred to as “PCs”) in business increases, prevention of virus infection and prevention of infection spread by early detection have become important issues. In particular, it is very important for a LAN administrator who has a plurality of PCs in a distributed manner to grasp the virus check status.
Conventionally, as a measure to prevent the spread of infection by early detection of a virus, a virus infection prevention method in a LAN environment, for example, starts a virus check tool (program) every time a client PC is started up and checks the virus infection status of a local drive. The method is common. In this way, it is possible to grasp the virus infection status using a known virus check tool, but this is only confirmed by the PC user, until the administrator grasps it. Was not reached.
In order for the administrator to grasp, it is necessary to check each user individually or check the check log for each user, which is a very laborious work. In addition, it is expected that confirmation will be difficult if the installation locations of PCs are dispersed and separated, or the number of PCs is large.
[0003]
Regarding virus checking, there are technologies described in, for example, (1) Japanese Patent Laid-Open No. 05-108487 and (2) Japanese Patent Laid-Open No. 06-348486. It is described. That is, in the former (1), a virus monitoring system is selectively interposed between the application and the operating system, and the monitoring system determines whether the content of the fetched request is normal or due to a computer virus, If it is due to a virus, the output means prohibits the request and issues an alarm. In the latter case (2), before the boot program is loaded and executed, writing to the storage device is prohibited by setting the setting / release switch, and after the program is loaded and executed, the computer is detected by a virus. Inspect whether it was attacked. This check is performed by comparing the interrupt vector loaded in the RAM with the corresponding normal value (stored in memory).
However, in (1) Japanese Patent Laid-Open Nos. 05-108487 and (2) Japanese Patent Laid-Open No. 06-348486, etc., the virus intrusion is prevented and detected on the client. Efficient use considering the central management of the situation is not considered at all.
[0004]
[Problems to be solved by the invention]
As described above, conventionally, in order for the LAN administrator to grasp the execution status and execution result of each client's virus check, it is necessary to confirm each client user individually, or by using a client execution log or the like. When a large-scale LAN is constructed, management becomes extremely difficult due to the number of clients, remote location installation, and the like.
Therefore, an object of the present invention is to solve such problems, transfer the execution result log of the virus check tool to the server, and create an execution result list of each client based on the log file transferred in the server. It is an object to provide a server transfer / editing method of virus check results and a recording medium storing a program therefor.
[0005]
[Means for Solving the Problems]
In order to achieve the above object, (1) the virus check result server transfer / editing method according to the present invention monitors the virus check execution state, transfers the execution result log to the server at the end of execution, and transfers the transferred log file. Based on the above, a list of execution results of each client is created. (2) In the program storage recording medium, a monitoring program that monitors the operation status of the virus check tool for each client, a transfer program that is transferred to the server when the log ends, a setup program that sets each client environment, and a DLL A (Dynamic Link Library) file and an editing program are stored.
As a result, it becomes possible to manage the virus occurrence status of the client (centralized server management) regardless of the installation location, and to reduce the man-hours for grasping the virus infection status.
[0006]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below in detail with reference to the drawings.
FIG. 2 is a diagram showing a hardware environment to which the present invention is applied.
In FIG. 2, 111a, 111b,... 111n are client PCs, 120 is a server, and 13 is an administrator terminal connected to the server.
In the present invention, the virus check result of the client PC 111 is centrally managed by the server so that the administrator can easily check the check result. For this purpose, a monitoring program, a transfer program, and a setup program are arranged on the client PC 111 side, and a DLL file and an editing program are arranged on the server 120 side. These programs are stored on a floppy disk. Needless to say, it can be stored in a fixed disk, a floppy rewritable disk, an optical disk or the like, and the present invention can be easily executed at any place by carrying the stored recording medium.
The virus check tool is activated for each client PC 111, the execution state thereof is monitored by the monitoring program, and when the execution of the tool is completed, the monitoring program activates the transfer tool (program). The transfer tool collects the result of the virus check tool execution executed on each client PC in a log, and transfers the log file to the server 120. The server 120 activates an editing tool (program) to create a check result list for each client or in date order, and the administrator terminal 13 refers to this list to confirm the check result of the client PC.
[0007]
FIG. 3 is an explanatory diagram of a recording medium on which each program of the present invention is recorded.
The program of the present invention is provided by the floppy disk 115, and the program is copied to the local drive of the client, and the execution environment of the present invention is set by the setup program. As shown in FIG. 3, there are five types of programs stored in the floppy disk 115: a monitoring program, a transfer program, a setup program, a DLL file, and an editing program.
Here, the DLL is a library file for Windows in which independent function objects are combined into one, and can be dynamically called when necessary when executing an application.
Note that the client environment is required to have about 60 kbytes of free disk space in order to load these programs.
[0008]
FIG. 1 is an operational flowchart of a server transfer / editing method for virus check results according to an embodiment of the present invention.
As shown in the flow of FIG. 1, the present invention is formed from the operations of steps (1) to (7). A thick line indicates an action (activation), a thin line with a double arrow indicates a reference (read access), and a thin line with a single arrow indicates a data flow. 111 is a client PC, 112 is a log file, 113 is a transfer tool, 114 is a status monitoring tool, 121 is a log file storage area, 122 is an editing tool, 123 is a check result list file, 120 is a server, and 11 is a client A side device, 12 is a server side device, and 13 is an administrator terminal.
[0009]
First, a known virus check tool is activated on the client PC 111 to check the virus infection status (step (1)). The status monitoring tool 114 provided by the present invention monitors the operating status of the virus check tool (step (2)). Log information acquired by executing the virus check tool is stored in the log file 112 for each client. When the virus check tool is finished, the state monitoring tool 114 activates the transfer tool 113 (step (3)).
The log file 112 for each client is transferred to the server 12 by the transfer tool 113 provided by the present invention (step (4)). The contents of the log file 112 for each client are transferred to the server 12 and stored in the log file storage area 121.
Next, the editing tool 122 provided by the present invention is activated by the administrator terminal 13 (step (5)). The log file 112 transferred to the server 12 is processed by the editing tool 122, and a virus check result list for each client is created (step (6)). The created result list is stored in the check result list file 123.
The administrator refers to the list created by the editing tool 122 from the administrator terminal 13 and confirms the check result for each client (step (7)).
[0010]
FIG. 4 is a diagram of the check result list created in FIG.
4A is a check result list arranged in order of date, and FIG. 4B is a check result list arranged for each client.
In the list of (a), only the clients A and B on January 8 are checking with the virus check tool. As a result, there was no abnormality in client A and there was abnormality in client B. The virus has been removed. The name of the executed vaccine software is described in the list. Since the virus check tool has not yet been checked for the clients C and D, the administrator will give an individual instruction by telephone or the like so as to be sure to execute it next time (date is undecided). It has become. Clients E and F were checked on January 10, indicating that client E was not abnormal and client F was abnormal, but the virus was removed by the vaccine software. As vaccine software, commercially available well-known software can be used.
[0011]
In the list of (b), the check result is described for each of the clients A, B, C,... For the client A, the check result on January 8 is normal, and the check on October 31 is checked. There was no abnormality in the results, and the check result on December 30 was abnormal, but it was shown that the virus was removed by the vaccine software and recovered. The name of the vaccine software used at that time is described. The client B has not yet been checked by the virus tick tool, so the administrator has instructed to do it next time. Even if the check log by the tool fails, no check result is output.
There is no problem if the clients in the vicinity of the client described with an abnormal x are ○, but there is a person who has not checked in the clients in the vicinity of the client described with an x, the entry of the virus Since the degree of risk is high, it is necessary to give instructions to the clients by telephone or the like from the administrator so that the check can be performed quickly.
[0012]
Each step (1) to (7) shown in FIG. 1 is converted into a program, and the converted program is stored in a recording medium such as a floppy disk so that it can be carried. The virus check result list of the present invention can be edited at the place.
[0013]
【The invention's effect】
As described above, according to the present invention, the LAN administrator confirms the editing result on the server, and whether or not the virus check of all clients is executed and the execution result regardless of the installation location / number of PCs. Can be managed in a unified manner, reducing the man-hours for grasping the virus infection status.
[Brief description of the drawings]
FIG. 1 is an operational flowchart of a server transfer / editing method for virus check results according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating a hardware environment in which the present invention is implemented.
FIG. 3 is a diagram showing a recording medium storing a program used in the present invention and a client environment.
FIG. 4 is a view showing a check result list according to the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 11 ... Client side apparatus, 12 ... Server side apparatus, 13 ... Administrator terminal,
111, 111a, 111b, 111n ... client PC, 120 ... server, 115 ... recording medium, 112 ... log file, 113 ... transfer tool,
114 ... Status monitoring tool, 121 ... Log file storage area,
122: Editing tool, 123: Check result list file.

Claims (2)

The monitoring program, the transfer program, and the virus check program are stored in the memory of the client terminal, and the check result list file and the editing program are stored in the memory of the server. From the client terminal and each processor or administrator terminal of the server In the server transfer / editing method of the virus check result of causing each program to be sequentially read from the memory and executed by the operation of
The processor of the client terminal sequentially reads and executes the virus check program from the memory, writes the log information acquired by the execution of the virus check program to the log file memory, and sequentially reads and executes the monitoring program from the memory, Monitor the execution status of the virus check program by reading the internal memory,
When the execution of the virus check program is completed, the instructions of the monitoring program are executed, so that the transfer program is sequentially read from the memory, and the log file data is sequentially read from the memory by executing the transfer program. Read and transfer the data to the server via the LAN,
The server processor receives the transferred log file data, writes the data to the memory, and then sequentially reads and executes the editing program from the memory by an operation from the administrator terminal, thereby storing the data in the memory. A virus check result server transfer / editing method comprising: creating a check result list for each client or in date order based on the log file data, and writing the list to the check result list file memory.   A computer-readable program recording medium for programming the procedure of the server transfer / editing method for virus check results according to claim 1 and recording the resulting program.

Images