JP2004046672A - Virus check system, mail client, and method and program for checking virus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reliably check that the mails received are virus mails if they are transmitted by a virus that attaches itself to a mail as an executable format file to automatically distribute the mail via an SMTP server, even if the virus is a new variety or modification of the original one. <P>SOLUTION: When receiving a mail with an attached executable format file, a receiving mail client 41 transmits a follow-up mail to ask a transmitting mail client 11 that transmitted the file if it has transmitted the file with the attached file. The transmitting mail client 11, when receiving the follow-up mail, checks if the mail with the attached file is a mail previously transmitted, based on a history of transmission. A follow-up mail showing the check result is sent back to the receiving mail client 41. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a virus check technique for checking whether or not a received electronic mail (mail) has been delivered by a computer virus (virus).
[0002]
[Prior art]
In recent years, e-mail has been increasingly used as a means for exchanging information, and a virus attached to e-mail and transmitted has become a serious problem. Some viruses send a large number of virus emails without the infectious person's notice by sending an email with the file attached as an executable file via an SMTP (Simple Mail Transfer Protocol) server directly without using an email client. And the risk of being infected with such a virus is increasing.
[0003]
By the way, in the past, a common method to prevent damage from viruses attached to e-mails is to use anti-virus software to check whether e-mails contain viruses, After confirming that they are not mixed, the user clicks the attached file.
[0004]
[Problems to be solved by the invention]
However, virus checking by anti-virus software cannot check for viruses that do not catch on new or modified search patterns, and there is a problem that the virus is infected by executing the attached file. .
[0005]
Therefore, an object of the present invention is to provide a case where a received virus is a mail transmitted by a virus which automatically attaches itself to a mail as an executable file via an SMTP server and is automatically delivered, and a virus of a transmission source is new or modified. The purpose is to make it possible to check whether a message is a virus mail.
[0006]
Japanese Patent Application Laid-Open No. H11-288390 discloses that in order to check whether or not a virus is mixed in a content downloaded from a server in a server or the like that relays the content, the downloaded content is returned to a transmission source server. A technique is described in which the server checks whether a virus is mixed in by comparing the content downloaded with the content returned, but a technique for checking a virus attached to an e-mail and delivered is described. is not.
[0007]
[Means for Solving the Problems]
The virus check system of the present invention achieves the above object,
The receiving mail client
When an e-mail with an attached file with an executable file attached is received, a confirmation is made as to whether or not the e-mail with the attached file has been sent to a sender mail client which is a source of the e-mail with the attached file. Equipped with a means for sending email,
The sending mail client is:
When the confirmation mail is received, a means is provided for checking whether or not the mail with the attached file has been transmitted based on a transmission history, and returning a confirmation result mail indicating a check result to the receiving mail client.
[0008]
In addition, the mail client of the present invention prevents the execution of the executable file attached to the email even if the executable file is clicked until it is confirmed that the virus is not included in the executable file.
The file name of the executable file in the received mail with the attached file is changed to a file name indicating a file other than the executable file, and when the confirmation result mail indicating that the mail with the attached file has been transmitted is received, the file name is changed. There is a means for restoring.
[0009]
[Action]
When a virus that infects a client machine sends a virus mail attached in the form of an executable file directly via an SMTP server without passing through a mail client, the transmission history does not remain in the mail client. Therefore, the receiving mail client receiving the mail with the executable file attached asks the sending mail client that sent the mail whether or not the mail has been sent. By checking whether or not the mail has been transmitted based on the above, it is possible to determine whether or not the mail is mail distributed by a virus.
[0010]
BEST MODE FOR CARRYING OUT THE INVENTION
Next, embodiments of the present invention will be described in detail with reference to the drawings.
[0011]
FIG. 1 is a block diagram of an embodiment of the present invention. Referring to FIG. 1, an embodiment of a virus check system according to the present invention includes a client machine 10 on the transmission side such as a personal computer, an SMTP server 20 for processing a mail transmission request from the client machine 10, and a computer such as a personal computer. It comprises a client machine 40 on the receiving side and a mail server 30 for processing a mail transmission / reception request from the client machine 40.
[0012]
The receiving client machine 40 includes a receiving mail client 41, a storage device 42 having a mail storage unit 421, and a recording medium K40.
[0013]
When the executable file is attached to the mail received via the mail server 30, the receiving mail client 41 determines whether or not the mail has been transmitted to the transmitting mail client that is the source of the mail. A function to send a confirmation e-mail to inquire about the file, a function to prevent the execution of the executable file from being clicked until a confirmation result e-mail is received from the sending e-mail client, When a confirmation result mail indicating that the mail is not transmitted from the transmitting mail client is received, a function to delete an executable file attached to the mail is provided.
[0014]
The receiving mail client 41 having such a function includes, for example, as shown in the block diagram of FIG. 2, a transmitting / receiving means 411, an attached file name changing means 412, a confirmation mail creating means 413, a check result mail content check. Means 414 and an attached file deleting means 415.
[0015]
The transmission / reception unit 411 has a function of storing the mail received via the mail server 30 in the mail storage unit 421, and, when an executable file is attached to the mail stored in the mail storage unit 421, the attached file name changing unit 412. The function of notifying the storage location of the mail to the user, the function of transmitting the confirmation mail passed from the confirmation mail creation unit 413, and the contents of the confirmation result mail when the mail stored in the mail storage unit 421 is the confirmation result mail It has a function of notifying the checking unit 414 of the storage location of the mail.
[0016]
The attached file name changing means 412 changes the file name of the attached file in the e-mail notified of the storage position from the transmitting / receiving means 411 to something other than the executable form, or changes the file name from the confirmation result e-mail content checking means 414. When the restoration is instructed, it has a function of restoring the file name of the attached file, a function of notifying the confirmation mail creation means 412 of the storage position of the mail, and the like. The file name is changed, for example, by replacing the extension of the original file name with “.txt”.
[0017]
The confirmation e-mail creating unit 413 creates a confirmation e-mail based on the e-mail whose storage location has been notified from the attached file name changing unit 412, with the destination, source, subject, and text as follows. It has a function to pass to.
[0018]
-Destination: Source of the received mail (client machine 10)
-Source: client machine 40 on the receiving side
Subject: a character string [check] indicating a confirmation mail to which a message ID and subject in the received mail are added. • body text: a body excluding attached files in the received mail (in the present embodiment, the body Is a predetermined character from the beginning, but may be the whole body.)
[0019]
If the body of the confirmation result mail notified of the storage location from the transmission / reception unit 411 is [OK] indicating that the inquired mail is transmitted, the confirmation result mail content checking unit 414 determines the attached file name. It instructs the changing means 412 to return the file name of the attached file to the original file name, and if it is [NG] indicating that the inquired mail has not been transmitted, the attached file deleting means 415 It has a function of instructing deletion of the attached file.
[0020]
The attached file deleting unit 415 has a function of deleting an attached file according to the instruction of the confirmation result mail content checking unit 414.
[0021]
The recording medium K40 is a disk, a semiconductor memory, or another recording medium, and stores a program for causing a computer to function as the receiving mail client 41. This program is read by a computer, and by controlling its operation, the transmission / reception means 411, the attached file name changing means 412, the confirmation mail creating means 413, the confirmation result mail content checking means 414, the attached file deleting means 415 is realized.
[0022]
The sending client machine 10 includes a sending mail client 11, a storage device 12, and a recording medium K10.
[0023]
The storage device 12 includes a mail storage unit 121 and a transmission history storage unit 122. The mail storage unit 121 stores the mail received by the sending mail client 11. The transmission history storage unit 122 stores transmission history information of the mail transmitted by the transmission side mail client 11. In the present embodiment, the subject in the transmitted mail and the text (predetermined characters from the beginning of the text excluding the attached file) are stored in the transmission history storage unit 122 as transmission history information.
[0024]
When a confirmation e-mail is sent from the reception e-mail client 41 to inquire whether the e-mail has been transmitted, the transmission e-mail client 11 transmits the inquired e-mail based on the contents stored in the transmission history storage unit 122. It has a function of checking whether the check has been performed and returning a check result mail indicating the check result to the receiving mail client 41.
[0025]
The transmission side mail client 11 having such a function includes, for example, as shown in the block diagram of FIG. 3, a transmission / reception unit 111, a transmission history check unit 112, and a confirmation result mail generation unit 113.
[0026]
The transmission / reception unit 111 has a function of storing the received mail in the mail storage unit 121, a function of notifying the storage position of the received mail to the transmission history check unit 112 when the mail stored in the mail storage unit 121 is a confirmation mail, It has a function of transmitting the confirmation result mail passed from the confirmation result mail creation unit 113, and a function of storing the subject and the head of the body of the transmitted mail in the transmission history storage unit 122. In the present embodiment, the transmission history information is stored in the transmission history storage unit 122 for all the transmitted mails, but only the transmission history information of the mail to which the executable file is attached among the transmitted mails is stored. The information may be stored in the transmission history storage unit 122.
[0027]
When the storage location of the confirmation mail is notified from the transmission / reception unit 111, the transmission history check unit 112 determines whether the mail inquired by the confirmation mail has been transmitted in the past based on the contents of the transmission history storage unit 122. And a function for notifying the check result to the confirmation result mail creating means 113.
[0028]
If the check result of the transmission history check unit 112 indicates that the mail is being sent, the confirmation result mail creation unit 113 sets the subject to the message ID “result” indicating the confirmation result mail. Is added, and a confirmation result mail whose body is [OK] is created. When it is indicated that the mail is not transmitted, subject is changed to a character string [result] indicating that the mail is the confirmation result mail. It has a function of creating a confirmation result mail with the message ID added and the body text as [NG], and a function of passing the created confirmation result mail to the transmission / reception unit 111.
[0029]
The recording medium K10 is a disk, a semiconductor memory, or another recording medium, in which a program for causing a computer to function as the transmission-side mail client 11 is recorded. This program is read by a computer, and by controlling the operation thereof, a transmission / reception unit 111, a transmission history check unit 112, and a confirmation result mail creation unit 113 are realized on the computer.
[0030]
Description of operation of the embodiment
Next, the operation of this embodiment will be described in detail with reference to the drawings. FIG. 4 is a flowchart showing an example of processing of the receiving mail client 41, and FIG. 5 is a flowchart showing an example of processing of the sending mail client 11.
[0031]
Now, for example, it is assumed that the client machine 10 is infected with the virus 13. Then, it is assumed that the virus 13 uses the settings of the client machine 10 and sends a virus mail 50 with itself attached as an executable file to the client machine 40 via the SMTP server 20. At this time, the virus 13 does not use the sending mail client 11 but directly uses the SMTP server 20, so that the history information of the virus mail 50 transmitted does not remain in the transmission history storage unit 122.
[0032]
When the transmission / reception unit 411 in the reception side mail client 41 receives the virus mail 50 from the client machine 10 (however, at this time, it is not recognized that the received mail is a virus mail), it stores it in the mail. It is stored in the section 421 and it is checked whether or not an executable file is attached (FIG. 4, steps A1, A2). In the case of this example, the executable file is attached to the received virus mail 50, so the transmitting / receiving means 411 notifies the attached file name changing means 412 of the storage location of the virus mail 50.
[0033]
As a result, the attached file name changing unit 412 changes the file name of the attached file in the virus mail 50 stored in the mail storage unit 421 to a file name other than the executable format (step A3). The attached file name changing means 412 stores the storage position of the virus mail 50, the file name before change, and the mail transmission source as a set. Thereafter, the attached file name changing unit 412 notifies the confirmation mail creating unit 413 of the storage location of the virus mail 50.
[0034]
As a result, the confirmation mail creation unit 413 creates a confirmation mail for inquiring whether the virus mail 50 has been transmitted to the sending mail client 11 based on the virus mail 50 stored in the notified storage location. I do. Specifically, the confirmation e-mail creating unit 413 extracts the body excluding the attached file from the virus mail 50, and uses predetermined characters from the beginning of the extracted body as the body of the confirmation e-mail (step A4). Further, the confirmation e-mail creating unit 413 sets a character string [check] indicating the confirmation e-mail to which the message ID and the subject in the virus e-mail 50 are added as a subject of the confirmation e-mail (step A5). After that, the confirmation mail creation unit 413 completes a confirmation mail with the destination (client machine 10) in the virus mail 50 and the client machine 40 as the destination, and passes it to the transmission / reception unit 411.
[0035]
The transmission / reception unit 411 transmits the confirmation mail passed from the confirmation mail creation unit 413 to the client machine 10 that is the source of the virus mail 50 (step A6), and waits for the confirmation result mail to be returned.
[0036]
When the transmitting / receiving means 111 in the client machine 10 receives a confirmation mail from the client machine 40 for inquiring whether or not the virus mail 50 has been transmitted (at this time, it is not recognized that the confirmation mail is a confirmation mail), it receives the confirmation mail. It is stored in the mail storage unit 121 and whether or not the received mail is a confirmation mail is checked by checking whether or not the head of the subject is [check] (FIG. 5, steps B1 and B2). ). In the case of this example, since the head of the subject of the received mail is [check], the transmission / reception unit 111 recognizes that the received mail is a confirmation mail (Yes in step B2), and checks the transmission history. The means 112 is notified of the storage location of the confirmation mail. If it is determined in step B2 that the received mail is not a confirmation mail (step B2 is No), a normal reception process is performed (step B9).
[0037]
When notified of the storage location of the confirmation mail, the transmission history check means 112 extracts the body (predetermined characters from the beginning of the body of the virus mail 50) and the subject from the confirmation mail, and further includes the subject in the extracted subject. The subject of the existing virus mail 50 is extracted. Thereafter, the transmission history check unit 112 checks whether transmission history information matching the combination of the extracted text and the subject of the virus mail 50 is stored in the transmission history storage unit 122, and checks the check result as a confirmation result mail. Notification is made to the creating means 113 (step B3).
[0038]
If the check result from the transmission history check unit 112 indicates that matching transmission history information is present, the confirmation result mail generation unit 113 transmits the text of the inquired mail when the matching transmission history information exists. [OK] indicating that this is the case, subject is a combination of a character string [result] indicating a confirmation result mail and a message ID, the destination is the client machine 40, and the transmission result is the client machine 10 An e-mail is created, and the created confirmation result e-mail is passed to the transmitting / receiving means 111 (Yes in step B4, B5, B7). On the other hand, if the check result from the transmission history check unit 112 indicates that there is no matching transmission history information, it indicates that the inquired mail has not been transmitted. [NG], a subject is a combination of a character string [result] indicating a confirmation result mail and a message ID, a confirmation result mail is created with the destination set to the client machine 40 and the transmission source set to the client machine 10. Then, the created confirmation result mail is passed to the transmission / reception means 111 (No in step B4, B6, B7). In the case of this example, the virus mail 50 for which the inquiry was made was transmitted directly by the virus 13 via the SMTP server 20 and the transmission history storage unit 122 does not store transmission history information regarding the virus mail 50. Then, a confirmation result mail whose body is [OK] is created.
[0039]
The transmission / reception unit 111 returns the confirmation result mail passed from the confirmation result mail creation unit 113 to the client machine 40 that transmitted the confirmation mail (step B8).
[0040]
When the transmission / reception unit 411 in the client machine 40 receives the confirmation result mail from the client machine 10 (at this point, it does not recognize that the received mail is the confirmation result mail), the transmission / reception unit 411 stores it in the mail storage unit 421. It is stored (FIG. 4, step A1). Thereafter, the transmission / reception unit 411 checks whether or not the head of the subject of the received mail is [result], thereby checking whether or not the received mail is the confirmation result mail (step A7). In this example, since the head of the subject of the received mail is [result], the transmission / reception unit 411 recognizes that the received mail is a confirmation result mail (Yes in step A7), and confirms the confirmation result. The storage location of the confirmation result mail is notified to the mail content checking means 414. If it is determined in step A7 that the received mail is not a confirmation result mail (step A7 is No), a normal reception process is performed (step A11).
[0041]
The confirmation result mail content check means 414 checks the content of the body of the confirmation result mail stored in the storage location notified from the transmission / reception means 411 (step A8). If the content of the body is [OK] (Yes in step A8), the mail inquired to the client machine 10 by the confirmation mail is the mail transmitted by the sending mail client 11 in the client machine 10. Therefore, the confirmation result mail content checking means 414 instructs the attached file name changing means 412 to return the file name of the changed attached file to the original executable file name. I do. At this time, the sender of the confirmation result mail is passed to the attached file name changing unit 412.
[0042]
The attached file name change unit 412 stores the storage position and file of the set of the stored storage position, file name, and transmission source, of which the transmission source matches the transmission source passed from the confirmation result mail content checking unit 414. Based on the file name, the file name of the attached file is returned to the original file name of the executable format, so that the file can be executed when clicked (step A9). In step A9, a process of deleting the set of the storage location, the file name, and the transmission source that matches the transmission source is also performed.
[0043]
On the other hand, when the text is [NG] (No in step A8), the mail inquiring the client machine 10 by the confirmation mail is transmitted from the transmission side mail client 11 in the client machine 10. Since it has been confirmed that the e-mail is unknown and the sender is unknown, it instructs the attached file deleting means 415 to delete the attached file. At this time, the confirmation result mail content checking unit 414 matches the transmission source of the confirmation result mail received by the transmission source among the set of the storage location, file name, and transmission source stored in the attached file name changing unit 412. The storage position of the set is acquired, and this storage position is passed to the attached file deletion unit 415. Further, after the storage position is acquired, the attached file name changing unit 412 is instructed to delete the set whose storage position is acquired. The attached file deletion unit 415 deletes the attached file of the corresponding mail based on the storage location of the mail notified from the confirmation result mail content checking unit 414 (step A10).
[0044]
In the above-described embodiment, whether or not the mail was sent in the past is determined based on the body of the mail and the subject. However, the determination is performed based on only the body of the mail or only the subject of the mail. It may be performed. Further, in the above-described embodiment, only the attached file of the virus mail is deleted, but the entire virus mail may be deleted. Further, in the above-described embodiment, the receiving mail client 41 performs the processing shown in the flowchart of FIG. 4, but the SMTP server 20 or the mail server 30 may perform the same processing.
[0045]
【The invention's effect】
As described above, the present invention automatically confirms whether or not the above-mentioned mail has been transmitted to the mail client which is the transmission source when receiving the mail with the attached file with the executable file attached. Therefore, if the received mail is a virus mail from a virus that is automatically delivered via an SMTP server, even if the sender's virus is a new or modified virus, it must be a virus mail. It can be surely checked. As a result, it is possible to provide a more secure e-mail environment without infecting by executing the attached file.
[0046]
In addition, the present invention has a means for changing the file name of the executable file in the mail with the attached file or for restoring the file, so that the executable file attached to the mail does not contain a virus. Until it can be confirmed, clicking on the executable will not run it.
[Brief description of the drawings]
FIG. 1 is a block diagram of an embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration example of a receiving mail client 41.
FIG. 3 is a block diagram showing a configuration example of a transmission side mail client 11;
FIG. 4 is a flowchart showing a processing example of a receiving mail client 41;
FIG. 5 is a flowchart showing a processing example of a sending mail client 11;
[Explanation of symbols]
Reference Signs List 10: client machine 11 on the transmitting side ... mail client 111 on the transmitting side ... sending / receiving means 112 ... sending history checking means 113 ... confirmation result mail creating means 12 ... storage device 121 ... mail storage unit 122 ... sending history storage unit 13 ... virus K10 Recording medium 20 SMTP server 30 Mail server 40 Receiving client machine 41 Receiving mail client 411 Transmitting / receiving means 412 Attached file name changing means 413 Confirmation mail creating means 414 Confirmation mail contents checking means 415 Attachment file deletion means 42 storage device 421 mail storage unit K40 recording medium 50 virus mail

Claims (11)

The receiving mail client
When an e-mail with an attached file with an executable file attached is received, a confirmation is made as to whether or not the e-mail with the attached file has been sent to a sender mail client which is a source of the e-mail with the attached file. Equipped with a means for sending email,
The sending mail client is:
Means for checking whether or not the mail with the attached file has been transmitted based on a transmission history when receiving the confirmation mail, and a means for returning a confirmation result mail indicating the check result to the receiving mail client. Characterized virus check system. An SMTP server that processes a mail transmission request from a sending mail client or a mail server that processes a mail reception request from a receiving mail client,
When an e-mail with an attached file with an executable file attached is received, a confirmation is made as to whether or not the e-mail with the attached file has been sent to a sender mail client which is a source of the e-mail with the attached file. Equipped with a means for sending email,
The sending mail client is:
Means for checking whether or not the e-mail with the attached file has been transmitted based on a transmission history when receiving the confirmation e-mail, and returning a confirmation result e-mail indicating a check result to a sender of the confirmation e-mail. A virus check system characterized by the following. Means for transmitting a confirmation mail inquiring whether or not the mail with the attached file has been transmitted when receiving the mail with the attached file attached to the executable file, wherein the destination of the confirmation mail is the attached file When a confirmation mail is received from the sending mail client that is the sender of the attached mail, it is checked whether or not the mail with the attached file has been sent based on the transmission history, and a confirmation result mail indicating the check result A means as a sending mail client for replying to the sender of the confirmation mail. The mail client according to claim 3,
The file name of the executable file in the received mail with the attached file is changed to a file name indicating a file other than the executable file, and when the confirmation result mail indicating that the mail with the attached file has been transmitted is received, the file name is changed. A mail client comprising means for restoring a message. The mail client according to claim 3 or 4,
A mail client, comprising: means for deleting an executable file in the mail with an attached file when receiving a confirmation result mail indicating that the mail with an attached file is not transmitted. A receiving side mail client which inquires a mail client, which is a source of the mail with an attached file, whether or not the mail with an attached file has been transmitted, when receiving the mail with an attached file attached with an executable file. Means for checking whether or not the mail with the attached file has been transmitted based on the transmission history in response to the confirmation mail from the user, and returning a confirmation result mail indicating the check result to the receiving mail client. A mail client characterized by the following. When the receiving mail client receives the mail with the attached file attached with the executable file, the receiving mail client sends the mail with the attached file to the sending mail client that is the source of the mail with the attached file. Send a confirmation email asking if
When the sending mail client receives the confirmation mail, checks whether or not the mail with the attached file has been transmitted based on a transmission history, and returns a confirmation result mail indicating the check result to the receiving mail client. A virus checking method characterized by: Computer
Means for transmitting a confirmation mail inquiring whether or not the mail with the attached file has been transmitted when receiving the mail with the attached file attached to the executable file, wherein the destination of the confirmation mail is the attached file When a confirmation mail is received from the sending mail client that is the sender of the attached mail, it is checked whether or not the mail with the attached file has been sent based on the transmission history, and a confirmation result mail indicating the check result For functioning as a sending mail client that replies to the sender of the confirmation mail. The program according to claim 8,
Said computer,
The file name of the executable file in the received mail with the attached file is changed to a file name indicating a file other than the executable file, and when the confirmation result mail indicating that the mail with the attached file has been transmitted is received, the file name is changed. Program to function as a means of restoring The program according to claim 8 or 9,
Said computer,
A program for functioning as a means for deleting an executable file in an e-mail with an attached file when a confirmation result e-mail indicating that the e-mail with an attached file is not transmitted is received. Computer
A receiving side mail client which inquires a mail client, which is a source of the mail with an attached file, whether or not the mail with an attached file has been transmitted, when receiving the mail with an attached file attached with an executable file. In response to the confirmation mail from the server, checks whether or not the mail with the attached file has been transmitted based on the transmission history, and functions as means for returning a confirmation result mail indicating the check result to the receiving mail client. Program.

Images