RU108168U1 - SYSTEM FOR HARDWARE ANTI-VIRUS SCAN AND TREATMENT OF INFORMATION STORAGE DEVICES - Google Patents

Abstract

 1. A system for hardware-based antivirus scanning and treatment of information storage devices, comprising at least:! the device connection interface associated with the controller, which is designed to connect the information storage device with the claimed system and read information, which are files stored on the information storage device; ! anti-virus module associated with the controller, which is designed for:! receiving files stored on the information storage device from the controller; ! antivirus scan of files, treatment of infected files and removal of malware; ! transmitting information about the progress of anti-virus scanning of files stored on the information storage device, and its results, as well as the progress and results of disinfection of infected files and removal of malware to the controller; ! mentioned controller, which is designed for:! receiving from the device’s connection interface files stored on the information storage device and transferring these files to the anti-virus module; ! receiving information from the anti-virus module on the progress of anti-virus scanning of files stored on the information storage device and its results, as well as on the progress and results of treating infected files and removing malware and transferring this information to the information display module; ! said information display module associated with the controller, which is intended to provide detailed information about the progress and results of anti-virus scanning of files stored on the information storage device, as well as the progress and results of disinfection of infected files and deleting

Description

Technical field

The utility model relates to systems for anti-virus scanning and treatment of information storage devices.

State of the art

Today it is impossible to even imagine the office of a modern company, no matter how large it is, without a computer network. Due to this, for example, there is always the possibility of a quick exchange of various information between personal computers (PCs) on the network. But the network infrastructure must be able to properly manage and control in order to solve the most complex problems. Control over PCs on the network must be carried out at the approaches to the resources of the corporate network. One of the main points of this control should be control over external devices for storing information, such as, for example, Flash-drives of information and other similar devices. Every day, hundreds of events are recorded in the corporate network related to the connection of such devices to a PC in the corporate network. And often events arise when the connected device for storing information contains malicious software (software), which can cause any malfunctions and difficulties in the work of a particular user of this PC. In addition, the corporate network is very vulnerable, and once an infected PC appears on the network, malware can spread to other PCs on the corporate network. Such incidents are fraught with the loss of working time by employees associated with troubleshooting PC problems caused by malware. Also, such incidents can lead to the loss of company trade secrets and even financial resources.

Even if an anti-virus application is installed on the user's PC, it is still not safe from possible infection of the PC when an infected device is connected to it to store information. A typical scenario for such a development of events may be the absence of a user at his workplace for a long period. During this period, his PC was turned off and the anti-virus databases were not updated. As soon as the user has returned to the performance of his duties, he connects a storage device to the PC. The information storage device contains malware that the antivirus application cannot detect due to the long absence of updates, the consequence of this is the infection of this PC, and in the worst case, an epidemic of a computer virus in the corporate network. Visitors also often come to the company - people who are not working in the company, who must use devices for storing information to carry out any work tasks, and often such devices of an outside visitor to the company can become a source of a computer virus epidemic in the company. Also, within the corporate network, situations may arise when an employee wants to check his device for storing information, knowing in advance or assuming that it contains malware. In this case, the employee can transfer this device for storing information containing malware to the information department of the company for verification and treatment, which takes administrators a certain amount of time that could be spent on solving other important problems.

There are also certain problems that can be caused by the treatment of an information storage device infected with malware, such as a flash drive. Flash drives can be damaged during the treatment with their antivirus application. Malicious software can be detected by an antivirus application, its executable components are deleted, and the autorun.inf file used to automatically launch applications and programs on storage media in the Microsoft Windows operating system remains from this malware. As a result, the Flash drive may no longer appear on the PC in the list of connected devices. Also, if, for example, an anti-virus application detects malware and attempts to cure or remove executable malware components, and the user removes the Flash drive from the PC at that moment, the file system of the Flash drive may be damaged and this may cause a complete loss the health of such a device. This is also due to the fact that the antivirus application, as a rule, does not inform the user that any actions aimed at treating or removing malware are performed with Flash drives.

To date, systems for anti-virus scanning and treatment of information storage devices are known.

In the application US 20090113128 A1 describes a system to prevent malware from entering the PC from any media, such as, for example, a flash drive. At the initial stage, the Flash drive works in read only mode, is checked by antivirus, and then full access rights are given. But this system is not implemented as a separate, non-PC device.

US Pat. No. 7,591,018 B1 describes a system for the hardware search and treatment of viruses. A special device containing an antivirus module in its memory can be connected to a PC. All storage media connected to this system are also checked by this system connected to a USB port. But this system requires a PC to work.

The utility model described below is intended to circumvent such difficulties.

Utility Model Essence

This utility model is intended for anti-virus scanning and treatment of information storage devices using a separate hardware device. The technical result is to increase the level of protection of the PC from malicious software and infected files distributed on storage devices. The system described below allows you to check information storage devices, such as Flash drives, treat infected files and / or delete malware on Flash drives outside the PC using a separate hardware device. A system for hardware-based antivirus scanning and treatment of information storage devices, comprising at least:

- the device connection interface associated with the controller, which is designed to connect the information storage device with the claimed system and read information, which are files stored on the information storage device;

- an anti-virus module associated with the controller, which is intended for:

- receiving files stored on the information storage device from the controller;

- antivirus scan of files, treatment of infected files and removal of malware;

- transferring information about the progress of anti-virus scanning of files stored on the information storage device, and its results, as well as the progress and results of disinfection of infected files and removal of malware to the controller;

- said controller, which is intended for:

- receiving from the device connection interface files stored on the information storage device and transferring these files to the anti-virus module;

- receiving information from the anti-virus module on the progress of anti-virus scanning of files stored on the information storage device and its results, as well as on the progress and results of disinfection of infected files and removal of malware and transmission of this information to the information display module;

- the mentioned information display module associated with the controller, which is designed to provide detailed information about the progress and results of anti-virus scanning of files stored on the storage device, as well as the progress and results of disinfection of infected files and removal of malware.

Brief description of the attached drawings

The accompanying drawings, which are included to provide an additional understanding of the utility model and form part of this description, show embodiments of the utility model and, together with the description, serve to explain the principles of the utility model.

The claimed utility model is illustrated by the following drawings, in which:

Figure 1 illustrates a diagram of a system for hardware antivirus scanning and treatment of information storage devices.

Figa, 2b illustrates the algorithm of the system for hardware-based antivirus scanning and treatment of information storage devices.

Figure 3 illustrates a diagram of a system for hardware antivirus scanning and treatment of information storage devices, made in the form of a separate PC in an anti-vandal package.

Description of Embodiments of a Utility Model

The objects and features of the present utility model, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present utility model is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than specific details for helping a specialist in the field of technology in a comprehensive understanding of a utility model, and the present utility model is determined only in the scope of the attached formula.

Figure 1 illustrates a diagram of a system for hardware antivirus scanning and treatment of information storage devices.

A system 101 for hardware-based antivirus scanning and treatment of information storage devices comprises an interface for connecting device 103, which in the example can be, for example, a USB port to which the device to be checked is connected, in the example, such as a flash drive 102. note that in the operation of this system 101, it may be provided that not only USB ports, but also MiniUSB ports, ports for reading various types of memory cards and other devices are provided as an interface for connecting device 103 Data storage, as well as interfaces such as, for example, eSATA and FireWire. It should also be noted that in the described system 101 there may be several connection interfaces of the device 103 implemented for various types of information storage devices. The connection interface of the device 103 is connected to the controller 105, which is designed to transfer data between all elements of the system 101 for hardware antivirus scanning and treatment of information storage devices. The controller 105 is connected to the communication module 106, in order to communicate with any PC, remote server or other similar device via the Internet. The communication module 106 may be, for example, a USB connector or an Ethernet port. In a private embodiment, the communication module 106 can operate using modern wireless standards such as UMTS / CDMA (3G), WIMAX / LTE (4G), WiFi, HSPA, EDGE, as well as using wired data transfer technologies such as Ethernet, optical fiber, ASDN, xDSL and others. The power module 104, associated with the controller 105, is designed to provide autonomous operation of the system 101 for a long time without recharging. Power module 104 may be a galvanic cell or a battery, such as a lithium-ion battery. The power module 104 may, for example, be charged by connecting a system 101 for hardware-based antivirus scanning and curing storage devices to any PC via a device 103 interface, such as a USB port. The controller 105 is also associated with the anti-virus module 107. The anti-virus module 107 is designed to check information storage devices, such as the flash drive 102, for infected files and malware, as well as to treat infected files and / or remove malware. Antivirus module 107 may be, for example, a product such as Kaspersky AntiVirus, AntiVirus for Windows Workstations, Kaspersky AntiVirus for Linux Workstations, McAfee AntiVirus, Norton AntiVirus, or another similar product. In a particular embodiment, the anti-virus module 107 can be presented in the form of several modules, each of which is designed to solve certain problems. For example, a separate module is intended for signature verification, another for heuristic analysis, and so on. Antivirus module 107 uses the RAM resources that a controller 105 can provide in a particular embodiment. Antivirus module 107 is connected to the database of antivirus module 110. The database of antivirus module 110 contains information necessary for the operation of antivirus module 107, such as signatures known today malware day, data necessary for heuristic analysis. Antivirus module 107 can place suspicious files in the database of antivirus module 110 for further transmission to the side of the company providing the antivirus solutions using the communication module 106. The memory module 108 associated with the controller 105 is designed to back up data recorded on the information storage device during an anti-virus scan. The memory module 108 may be, for example, a NOR or NAND type Flash memory unit. In a particular embodiment, the anti-virus module 107 and the database of the anti-virus module 110 are stored in the memory module 108. The controller 105 is also connected to the information display module 109, intended to inform the user about the progress of the anti-virus scan of the information storage device, about the result of the anti-virus scan, about the actions that are necessary commit after anti-virus scan and so on. The information display module 109 can be implemented as, for example, a touch screen that allows the user to obtain detailed information about all checked, cured or deleted files at all stages of the operation of this system 101. In a particular embodiment, the information display module 109 can be implemented as an LED indicator, allowing determine the progress of anti-virus scanning and various color indications corresponding to events such as "The flash drive is checked and does not contain infected files and / or malware", as well as the "Flash drive is checked and contains infected files and / or malware. The information display module 109 can also be presented as a speaker and can use sound signals that allow the user to evaluate events such as the end of an anti-virus scan or the presence of a Flash- drive 102 of suspicious files, infected files, or malware that cannot be cured or deleted. It is worth noting that such modules as power supply module 104, memory module 108, communication module 106 and anti-virus module database 11 0 are optional, and a system for hardware-based antivirus scanning and treatment of information storage devices can function without them.

It is worth noting that there may be other options for implementing this system 101, and in a particular embodiment, this system 101 may, for example, be a special USB adapter inserted into the USB port of a PC. A flash drive 102 or other information storage device is inserted into this adapter. The system 101, implemented in the form of such an adapter, provides verification and treatment of the Flash drive 102 or other information storage device. In another private implementation, the system 101 may be a USB hub that allows you to check and treat multiple Flash drives 102 or other storage devices.

On figa, 2b depicts the algorithm of the system for hardware antivirus scanning and treatment of information storage devices.

At step 201, a user for anti-virus scanning of his information storage device, for example, Flash drive 102, connects it to the connection interface of device 103 of system 101 for hardware-based anti-virus scanning and treatment of information storage devices, which is, for example, a USB port.

Further, the operation of the system 101 continues at step A 202, which is shown in FIG. 2b. Stage A 202 is divided into stages where, using the system 101 for hardware-based antivirus scanning and treatment of information storage devices, the device is identified, backed up, the device is scanned for viruses, infected files are treated and / or malware is removed, as well as data collection and reverse communication with the user.

At step 2021, after the information storage device, such as the flash drive 102, is connected to the connection interface of the device 103 of the system 101 for anti-virus scanning and treatment of its information storage device, such as a USB port, the controller 105 will start receiving from this Flash- drive 102 information stored on it. Before receiving information directly stored on the flash drive 102, the controller 105 receives data from the flash drive 102, such as information about the name of the drive, the type of memory chip and its size, manufacturer, as well as other similar data defining this flash drive 102 A part of this data defining this Flash drive 102 is hereinafter used as an identifier for the Flash drive 102. So, for example, after receiving the data defining this Flash drive 102, the controller 105 creates a backup area, for example, a partition and whether the folder in the memory module 108 is specifically for the connected Flash drive 102, using any data that defines the connected Flash drive 102 for the name of this section or folder. For example, the controller 105 can select the name Flash for the name of the section or folder in the memory module 108 drive 102, the amount of its memory and information about the manufacturer of this Flash drive 102. It should be noted that the data collected by the controller 105 at the initial stage and determining this Flash drive 102 can be used in any amount for the purposes of subsequent identification nation.

After the controller 105 creates a section or folder in the memory module 108 for this Flash drive 102, at step 2022, the controller 105 saves to this section or folder all the information recorded on this Flash drive 102. Thus, in the memory module 108, a backup copy of all the information recorded on the Flash drive 102 will be saved. A backup copy of the data will be recorded on the Flash drive 102 if any errors occur during the anti-virus scan and disinfection performed by the anti-virus module 107.

Next, at step 2023, the controller 105 will also transmit the information recorded on the Flash drive 102 to the anti-virus module-107 for the purpose of anti-virus scanning. It should be noted that the order of transmission of information in various embodiments of the system 101 may be different. So, for example, in one embodiment of the system 101, the anti-virus scan step may be carried out simultaneously with the backup step. Receiving information from the controller 105, the anti-virus module 107, using data from the database of the anti-virus module 110, starts an anti-virus scan, informing the controller 105 of each file that has been scanned and the time until the end of the scan. The controller 105 transmits this information to the information display module 109. Thus, the user receives feedback during the scanning process and, depending on the execution of the information display module 109, can see information such as dynamically changing information about the last checked file and the time until the end of the anti-virus scan . In another embodiment of the information display module 109, the user can simply see, for example, the progress of the anti-virus scan procedure. The information display module 109 also informs the user about the moment when he can remove the Flash drive 102 from the system 101 for hardware-based antivirus scanning and disinfection of information storage devices without the risk of information loss or damage to the flash drive 102. Further, if the anti-virus module 107 was detected malware or infected files, the anti-virus module 107 will disinfect infected files and / or remove malware.

Also, at step 2024, the database of the anti-virus module 110 will collect statistical information about the scanned files and malware found on the Flash drive 102. In the database of the anti-virus module 110, a section will be created that belongs to this Flash drive 102, using any information that identifies this Flash drive 102 for the name of this section. All information about the scanned files found and deleted or not deleted malware, and also about cured or not cured files from this Flash drive 102 is stored in the corresponding section of the database of the anti-virus module 110. In the future, for example, this information can be sent to the side of the company providing th antivirus solutions for deeper analysis.

Next, at step 203, the results of anti-virus scanning and treatment of infected files and / or malware removal are controlled. For example, antivirus module 107 may detect suspicious files on the flash drive 102 that may be malicious. This may also happen due to the fact that the database of the anti-virus module 110 does not contain current information.

If at step 203 the antivirus module 107 did not detect any suspicious files on the flash drive 102 that could be malicious, and all infected infected files were cured and deleted all detected malware, then the system 101 continues at step 204.

At step 204, the anti-virus module 107 will transmit information to the controller 105 about all found and removed malware, as well as about all infected files that have been disinfected. The controller 105 will transmit such information to the information display module 109, which, depending on the implementation options, for example, can display information about which files were deleted and which were cured, which malware was on the flash drive 102, and so on. Depending on the implementation of the information display module 109, the user may also receive sound information that he can associate with an event such as the end of the anti-virus scan and the absence of suspicious files or any other threats on the flash drive 102. If the information display module 109 is implemented in another way and allows the user to see the dynamics of the anti-virus scan process and various color displays after the anti-virus scan is completed, which corresponds to any events, o in this case, in addition to the above, the anti-virus module 107 can generate a report in any text format and transfer it through the controller 105 to the flash drive 102. Information can be stored in the report describing the scanned files, malware found, infected and cured or deleted files, actions that should or should not be done by the user, and so on. Also, at this stage, a backup copy of the data recorded in the backup area, such as, for example, the section or folder in the memory module 108 for the connected Flash drive 102, will be deleted. The anti-virus module 107 sends information to the controller 105 about what is on the Flash drive 102 no suspicious files were found, and all infected files were disinfected and / or malware removed. The controller 105 then deletes the backup and the backup area.

If at step 203 the anti-virus module 107 detects suspicious files on the flash drive 102 that may be malicious, or some of the detected infected files were not cured or some malware was not removed from the detected during the anti-virus scan, then system operation 101 continues to step 205.

At step 205, the anti-virus module 107 will transmit information to the controller 105 about all detected suspicious files that may be malicious. The controller 105 will transmit such information to the information display module 109, which, depending on the implementation options, for example, can display information about which files are suspicious. Also, the anti-virus module 107 can transmit recommendations for the user in this situation. A similar recommendation could be to inform the user with the help of the information display module 109 that suspicious files were found on his Flash drive 102, and recommendations to refrain from working with this Flash drive 102, as well as to be re-checked using system 101 for a hardware antivirus checking and treating information storage devices after a while. Depending on the implementation, the information display module 109, the user may receive sound information that he can associate with an event such as the detection of suspicious files on the Flash drive 102, or with some other event described above. In a particular embodiment, a user of the system 101, having received using the information display module 109 information that suspicious files and names of these files are located on the flash drive 102, can use the information display module 109, which in the particular embodiment is a touch screen , mark those files that he considers safe.

At step 206, information about suspicious files that may be malicious, as well as information about some of the detected infected files that have not been cured, and / or malware that has not been removed, is transferred to the side of the company providing the antivirus solutions. Also, in a private embodiment, information about suspicious files that the user considers safe can be transmitted. Such actions are performed using the communication module 106. Depending on the implementation, the communication module 106 may use both wired and wireless communication. In the case of wired communication, the communication module 106 may be, for example, a USB connector or an Ethernet port. In this case, the system 101 for hardware-based antivirus scanning and treatment of information storage devices can be connected using a communication module 106 to any PC, with the possibility of access to the Internet. The controller 105 receives information about the established connection with the PC from the communication module, and the controller 105 informs the anti-virus module 107 about it. The anti-virus module 107 informs the controller 105 of the Internet resource of the company providing the anti-virus solutions, after which the controller 105 transmits this information to the communication module 106 In a particular case, information such as addresses of Internet resources can be recorded in the controller 105, and after receiving information about the established connection with the PC from the communication module 106, the controller 105 informs it of the need sary address. The communication module 106 establishes a connection with these Internet resources. Next, the anti-virus module 107 transmits statistical information from the database of the anti-virus module 110, which contains information about suspicious files and about the part of the detected infected files that has not been cured, and / or about malware that has not been removed, to the controller 105, which in turn, transmits this information to the communication module 106. The communication module 106 transmits this information to the Internet resources of a company providing anti-virus solutions. If the communication module 106 is implemented using wireless technology, for example, 3G and there is the possibility of making an Internet connection without the help of a third-party PC, then the steps described above, that is, the transfer of information about suspicious files and some of the detected infected files, that has not been cured, and / or about malware that has not been removed, can be implemented by the communication module 106 immediately after an anti-virus scan of the information storage device. The transfer of such information at step 206 will help in the future to find a solution to problems, both general and particular. For example, one of the solutions to such problems could be updating anti-virus databases. The transfer of information about those suspicious files that the user considers safe will also allow the company providing the antivirus solutions to further update the list of those files in the antivirus database that do not pose a threat.

At step 207, in response to transmitting information about suspicious files and about a portion of the detected infected files that has not been cured and / or about malware that has not been removed, the communication module 106 from the company providing the antivirus solutions can receive, for example, an updated anti-virus database. Also, the communication module 106 may receive a characteristic solution to a problem. This can be, for example, a script or instruction to cure the desired file or remove malware, as well as information to determine whether a suspicious object is harmful, and if the object is malicious, delete it or cure it. Further, the anti-virus database or other similar information will be sent by the communication module 106 through the controller 105 to the anti-virus module 107, which will update the current anti-virus database stored in the database of the anti-virus module 110 to a new one received from the company providing the anti-virus solutions.

After that, during a repeated check at step 208 of this Flash drive 102, all suspicious files that were identified as malicious are deleted or cured, as well as some of the previously detected and untreated infected files are cured and / or previously uninstalled malware is removed. The system 101 will end at step 204, when the user, using the information display module 109, is informed about the successful completion of the anti-virus scan process.

In a particular embodiment, the communication module 106 is intended, for example, to transfer data about suspicious files and some of the detected infected files that have not been cured, and / or malware that has not been deleted, to any PC within network, for example, on the administrator’s PC. Thus, the administrator will know which storage device is infected, which PCs may be potentially infected, and, based on the data received, the administrator will perform actions to minimize malicious activity on the network.

Figure 3 shows a diagram of the system for hardware antivirus scanning and treatment of information storage devices, made in the form of a separate PC in an anti-vandal package.

Such a separate PC 301 in an anti-vandal package 302, designed for anti-virus scanning and treatment of information storage devices, such as Flash drives 102, can be installed in any company anywhere.

PC 301 contains a central processor 303, a system memory 304, and a system bus 313 that contains various system components, including memory associated with the central processor 303. The system bus 313 is implemented like any bus structure known in the art, which in turn contains a bus memory or a bus memory controller, a peripheral bus, and a local bus that is capable of interfacing with any other bus architecture. The system memory contains read-only memory (ROM) 305, random access memory (RAM) 307. The main input / output system (BIOS) contains procedures that ensure the transfer of information between the elements of the PC 301, for example, at boot time using the ROM 305.

The PC 301 in turn contains a hard disk 317 for reading and writing and an optical drive 319 for reading and writing to removable optical disks 320, such as CD-ROMs, DVD-ROMs and other optical information carriers. Moreover, the presence of an optical drive 319 in this case is optional in nature, as well as the presence of a magnetic disk drive for reading and writing to removable magnetic disks and an appropriate interface for it. The hard disk 317 and the optical drive 319 are connected to the system bus 313 through the interface of the hard disk 316 and the interface of the optical drive 318, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, program modules and other data of PC 301. This description discloses an implementation of a system that uses a hard disk 317 and a removable optical disk 320, but it should be understood that other types of computer storage media that can store data in a form readable by a computer (magnetic tape cassettes, digital disks, memory with nym access memory (RAM), read-only memories (ROMs) and the like). One such medium, for verification of which a similar separate PC 301 in the anti-vandal housing 302 is intended, is a flash drive 102.

PC 301 also has a file system 309, where the recorded operating system 308, antivirus application 321, and data 322 necessary for the antivirus application 321 to work, are stored 322. The antivirus application may include products such as Kaspersky Anti-Virus, Anti-Virus for Windows Workstations, Kaspersky Anti -Virus for Linux Workstations and other similar products. The data 322 necessary for the operation of the anti-virus application 321 may be, for example, anti-virus databases. The user does not have the ability to enter commands and information into PC 301. PC 301 is located in the anti-vandal case 302, and only a special employee, for example, an employee of the company's information security department, can access PC 301, that is, it can open or remove (depending on execution ) anti-vandal housing 302. A special worker can connect input devices, such as a keyboard, a mouse, or other devices, with the aim of entering commands and information into PC 301. I connect such input devices in my usual way t through the serial port 323, which in turn is connected to the system bus 313, but can be connected in another way, for example, using a parallel port, a game port, or via the universal serial bus (USB). A monitor 324 or another type of display device, such as, for example, LED indicators, is also connected to the system bus 313 via an interface, such as a video adapter 314. The monitor 324 may be integrated into the anti-vandal housing 302 or installed anywhere outside of it.

PC 301 is capable of operating in a networked environment, using a network connection with another or several remote computers 326. The remote computer (s) 326 are the same personal computers or servers that have most or all of the elements mentioned above in the description creatures PC 301 of FIG. 3. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 327 and a wide area network (WAN) 328. Such networks are used in corporate computer networks, company internal networks and, as a rule, have access to the Internet. When using LAN or WAN networks, PC 301 is connected to LAN 327 via a network adapter or interface 325. The network adapter or interface 325 can be either an Ethernet network card or a wifi network card. At the same time, for example, when the system is running, no other PC from this network has access to PC 301, which is intended for anti-virus scanning and treatment of information storage devices. Only an employee of the information security department of a company can have access via local network 327 to this PC 301 for the purpose, for example, remote installation of any software, updates of an anti-virus application, analysis obtained during an anti-virus scan of data storage devices, and so on. When using networks, PC 301 may use modem 329 or other means of establishing communication with wide area network 328, such as the Internet. The modem 329, which may be internal or external, is connected to the system bus 313 via the serial port 323 or otherwise. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration of the network, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

Using a modem 329 or other means of establishing communication with a global computer network 328, such as the Internet, communication can be made with the servers of a company providing anti-virus services in order to update anti-virus databases, transmit data on detected types of threats, and transmit data on suspicious objects for further a deep analysis of such objects for their harmfulness and so on. Communication with the servers of the company providing the anti-virus services via the global computer network 328, such as the Internet via the modem 329, initiates the anti-virus application 321.

PC 301 also has a USB port 315, which in the current embodiment has been moved outside of PC 301 and can be integrated, for example, into the anti-vandal housing 302. In other implementations, for example, a USB port 315 located on the monitor 324 can be used for this. .

Any employee can use this PC 301 in the anti-vandal housing 302 to check and treat their Flash drive 102. The user inserts the Flash drive 102 into the USB port 315. Further, the system works similarly to the implementation option described above. The functions of the connection interface of the device 103 are provided by the USB port 315, the functions of the controller 105 are performed by the system bus 313 and the processor 303, the functions of the anti-virus module 107 and the associated database of the anti-virus module 110 are performed by the anti-virus application 321 and the necessary data 322 for the anti-virus application 321 to work , the functions of the information display module 109 are provided by the monitor 324 connected to the video adapter 314, the functions of the memory module 104 are performed by the hard disk 317, the functions of the communication module 106 are provided by the network interface with 325 and a 329 modem connected to any port 323.

In conclusion, it should be noted that the information provided in the description are examples that do not limit the scope of the present utility model defined by the formula. The person skilled in the art will understand that there may be other options for implementing this utility model, consistent with the nature and scope of this utility model.

Claims (21)

1. A system for hardware-based antivirus scanning and treatment of information storage devices, comprising at least: the device connection interface associated with the controller, which is designed to connect the information storage device with the claimed system and read information, which are files stored on the information storage device; anti-virus module associated with the controller, which is designed to: receiving files stored on the information storage device from the controller; antivirus scan of files, treatment of infected files and removal of malware; transmitting information about the progress of anti-virus scanning of files stored on the information storage device, and its results, as well as the progress and results of disinfection of infected files and removal of malware to the controller; said controller, which is intended for: receiving from the device’s connection interface files stored on the information storage device and transferring these files to the anti-virus module; receiving information from the anti-virus module on the progress of anti-virus scanning of files stored on the information storage device and its results, as well as on the progress and results of treating infected files and removing malware and transferring this information to the information display module; said information display module associated with the controller, which is intended to provide detailed information about the progress and results of anti-virus scanning of files stored on the information storage device, as well as the progress and results of disinfection of infected files and removal of malware. 2. The system according to claim 1, in which the storage device is at least a flash drive, a memory card of any known type, a hard disk drive. 3. The system according to claim 1, in which in addition to the files stored on the information storage device, the information that the device connection interface reads out is data that defines the information storage device. 4. The system according to claim 3, in which the data defining the information storage device are at least such parameters as: information about the name of the drive; memory chip type; memory size; drive manufacturer. 5. The system according to claim 1, which further comprises a power module, designed to provide autonomous operation of the system. 6. The system according to claim 1, which further comprises a memory module for storing in a backup area for a given information storage device a backup of files stored on the information storage device. 7. The system according to claim 6, in which the backup area in which the controller stores files stored on the information storage device as a backup is at least a folder in the memory module. 8. The system according to claim 7, in which the backup copy of the files stored by the controller in the backup area is intended for the controller to write to the information storage device if errors occur during the anti-virus scan, treatment and removal of malware performed by the anti-virus module. 9. The system according to claim 7, in which the backup area is cleared by the controller after the anti-virus module performs anti-virus scanning, treatment and removal of malware, in the event that no suspicious files that may be malicious are detected, as well as if all infected files are cured and malware removed. 10. The system according to claim 1, which additionally contains a communication module designed to receive from the anti-virus module through the anti-virus controller statistics for the purpose of transmitting to a third party, receiving any information from a third party and transmitting this information through the controller to the anti-virus module. 11. The system of claim 10, in which the anti-virus statistics are at least parameters such as name, checksum, size, extension of suspicious files that may be malicious, infected files that were or were not cured, and malware that has been or has not been removed. 12. The system of claim 10, in which the third party is a company - a manufacturer of antivirus solutions. 13. The system of claim 1, wherein the detailed information provided by the information display module is at least a name, size, extension, malware status, status of actions taken. 14. The system of claim 13, wherein the malware statuses are at least such statuses as: secure file; a dangerous file, that is, an infected file or a file that is malware; suspicious file. 15. The system according to item 13, in which the statuses of the actions taken are at least such statuses as: successful or unsuccessful treatment; successful or unsuccessful deletion; third-party transmission of anti-virus statistics. 16. The system of claim 1, wherein the information display module is at least a touch screen, an LED indicator, a speaker. 17. The system according to claim 1, in which the controller is connected with such additional means as a memory module and a communication module and is intended for: receiving data from the device’s connection interface defining the information storage device; create in the memory module a backup area for a given information storage device, moreover, data identifying the information storage device is used as an identifier of this storage area; receiving from the device connection interface files stored on the information storage device and storing these files as a backup in the backup area for the information storage device created in the memory module; transmitting anti-virus statistics to the communication module for the purpose of subsequently sending such information to a third party and receiving from the communication module any information transmitted by a third party with subsequent transmission of this information to the anti-virus module. 18. The system according to claim 1, in which the anti-virus module is associated with such an additional tool as the database of the anti-virus module and is intended for: creating a section in the database of the anti-virus module for storing anti-virus statistics, moreover, data identifying the information storage device is used as an identifier for this section; transmitting anti-virus statistics to the controller; receiving any information from a third party transmitted through the controller and storing it in the database of the anti-virus module, 19. The system of claim 18, wherein the anti-virus module database contains information necessary for the anti-virus module to work, as well as anti-virus statistics for each checked and cured information storage device. 20. The system according to claim 19, in which the information necessary for the operation of the anti-virus module and contained in the database of the anti-virus module are at least the signatures of known malware and the data necessary for heuristic analysis. 21. The system of claim 18, wherein the database of the anti-virus module is regularly updated by receiving any information from a third party in order to improve the quality of anti-virus scanning of files, treating infected files and / or removing malware.