System and method for blocking harmful information online, and computer readable medium therefor

Abstract

A system and method are provided for diagnosing, remedying and blocking harmful information including computer viruses online over a computer network via which a web server and a client are linked to each other. The method includes, on a computer network through which a web server and a client system are linked to each other, the web server receiving a connection request from the client system over the computer network. Then, the web server transmits a harmful information blocking code module to the client system. Once the transmission of the harmful information blocking code module is completed the harmful information blocking code module automatically runs on the client system to block in real time harmful information including computer viruses. The harmful information blocking code module is automatically transmitted to and installed in the client system only by online connecting to the harmful information management server, so that the harmful information detected on the client system can be actively blocked in real time without requiring a manual installation process.

1. A method for blocking in real time harmful information in a file to be executed, the method comprising the steps of:
 (a) on a computer network through which a web server and a client system are linked to each other, the web server receiving a connection request from the client system over the computer network;  
 (b) the web server transmitting a harmful information blocking code module to the client system; and  
 (c) once the transmission of the harmful information blocking code module is completed, the harmful information blocking code module automatically running on the client system to block in real time harmful information including computer viruses,  
 wherein the step (c) comprises steps of:  
 (c1) inspecting file input/output (I/O) on the client system by hooking up file I/O routines,  
 (c2) determining whether the file to be executed corresponding to the inspected file input/output in the step (c1) is harmful or not; and  
 (c3) treating a file determined to be harmful in the step (c2) and executing the file, if it can be treated, and aborting the execution of the file determined to be harmful in the step (c2), if it cannot be treated.  
 
     
     
       2. The method of  claim 1 , wherein in the step (c3), if the file determined to be harmful in the step (c2) cannot be treated, the file is transmitted to the web server. 
     
     
       3. The method of  claim 1 , wherein the step (c3) comprises requesting the client system user's approval for the execution of the step (c3). 
     
     
       4. The method of  claim 1 , wherein the step (c) further comprises steps of:
 (c4) inspecting network packet input/output ( 1 / 0 ) on the client system;  
 (c5) determining whether packets inspected in the step (c4) are harmful or not; and  
 (c6) if any packet is determined to be harmful, blocking a communication port assigned for the packet I/O.  
 
     
     
       5. The method of  claim 1 , wherein the harmful information blocking code module executed in the step (c) checks whether current processes running on the client system are harmful or not. 
     
     
       6. The method of  claim 1 , wherein the harmful information blocking code module executed in the step (c) displays its running status in a separate window, and the execution of the harmful information blocking code module is aborted when the separate window is closed. 
     
     
       7. The method of  claim 1 , wherein the harmful information blocking code module executed in the step (c) continues to run on the client system even when the client system accesses another web server. 
     
     
       8. A method for blocking in real time harmful information in a file to be executed, the method comprising the steps of:
 (a) on a computer network through which a first web server, a second web server and a client system are linked to each other, the client system connecting to the second web server over the computer network;  
 (b) the client system connecting to the first web server over the computer network, according to information provided from the second web server to the client system;  
 (c) the first web server transmitting a harmful information blocking code module to the client system; and  
 (d) once the transmission of the harmful information blocking code module is completed, the harmful information blocking code module automatically running on the client system to block in real time harmful information including computer viruses,  
 wherein the step (d) comprises steps of:  
 (d1) inspecting file input/output (I/O) on the client system by hooking up file I/O routines;  
 (d2) determining whether the file to be executed corresponding to the inspected file input/output in the step (d1) is harmful or not; and  
 (d3) treating a file determined to be harmful in the step (d2) and executing the file, if it can be treated, and aborting execution of the file determined to be harmful in the step (d2), if it cannot be treated.  
 
     
     
       9. The method of  claim 8 , wherein the harmful information blocking code module executed in the step (d) continues to run on the client system even when the client system accesses another web server. 
     
     
       10. A method for blocking in a real time harmful information in a file to be executed in real time, the method comprising steps of:
 (a) on a computer network through which a first web server and a client system are linked to each other, the first web server receiving a connection request from the client system over the computer network;  
 (b) the connection request is issued by the client system according to information provided from a second web server after the client system is connected to the second web server separated from the first web server;  
 (c) once the first web server transmits a harmful information blocking code module to the client system, the harmful information blocking code module automatically running on the client system to block in real time harmful information including computer viruses,  
 wherein the step (d) comprises steps of:  
 (c1) inspecting file input/output (I/O) on the client system by hooking up file I/O routines;  
 (c2) determining whether the file to be executed corresponding to the inspected file input/output in the step (c1) is harmful or not; and  
 (c3) treating a file determined to be harmful in the step (c2) and executing the file, if it can be treated, and aborting execution of the file determined to be harmful in the step (c2), if it cannot be treated.  
 
     
     
       11. The method of  claim 10 , wherein the harmful information blocking code module transmitted in the step (c) continues to run on the client system even when the client system accesses another web server. 
     
     
       12. A system for blocking in real time harmful information in a file to be executed, comprising:
 a first web server for providing online services through a computer network; and  
 a client computer linked with the first web server via the computer network,  
 wherein when the first web server receives a connection request from the client system, the first web server transmits a harmful information blocking code module to the client computer, and the harmful information blocking code module is automatically executed on the client computer to block in real time harmful information including computer viruses, and wherein the harmful information blocking code module inspect file input/output (I/O) on the client system by hooking up file I/O routines, and  
 determines whether the file to be executed corresponding to the inspected file input/output is harmful or not: and  
 treats a file determined to be harmful and executes the file, if it can be treated, and aborts the execution of the file determined to be harmful, if it cannot be treated.  
 
     
     
       13. The system of  claim 12 , wherein the harmful information blocking code module displays its running status on a separate window, and the execution of the harmful information blocking code module is aborted when the separate window is closed. 
     
     
       14. The system of  claim 12 , further comprising a second web server linked to the client computer through the computer network to provide online services through the computer network, and
 wherein when the client computer is connected to the second web server through the computer network, the second web server provides the client computer with hyperlink information used to access to the first web server.  
 
     
     
       15. The system of  claim 12 , wherein the harmful information blocking code module continues to run on the client computer even when the client computer accesses another web server. 
     
     
       16. A method for blocking harmful information, the method comprising:
   receiving a request from a client system;        transmitting a harmful information blocking code module to the client system;        wherein the harmful information blocking code module runs on the client system to block in real time harmful information when the transmission of the harmful information blocking code module is completed, the harmful information blocking code module configured to:      inspect network packet input/output  ( I/O )  on the client system,        determine whether at least one of packets transmitted to the inspected network packet I/O is harmful or not, and        block an internal process for supporting the network packet I/O, if any packet is determined to be harmful.       
     
     
       17. The method of  claim 16 , wherein the harmful information blocking code module intercepts at least one of network packet input/output routines to inspect the network packet input/output. 
     
     
       18. The method of  claim 16 , wherein the internal process comprises at least one of socket I/O routines. 
     
     
       19. The method of  claim 16  wherein the harmful information blocking code module automatically runs on the client system when the transmission of the harmful information blocking code module is completed. 
     
     
       20. The method of  claim 16 , wherein the harmful information blocking code module displays advertising contents in a separate window. 
     
     
       21. The method of  claim 16 , wherein the harmful information blocking code module is an object coded program linked to a web browser. 
     
     
       22. The method of  claim 21 , wherein the object coded program is ActiveX control, Java applet or Java script. 
     
     
       23. A method for blocking harmful information, the method comprising:
   sending a request to download a harmful information blocking code module;        downloading the harmful information blocking code module;        wherein the harmful information blocking code module automatically runs on a client system to block in real time harmful information when the downloading of the harmful information blocking code module is completed, the harmful information blocking code module configured to:      inspect network packet input/output  ( I/O )  on the client system,        determine whether at least one of the packets transmitted to the inspected network packet I/O is harmful or not, and        block an internal process for supporting the network packet I/O, if any packet is determined to be harmful.       
     
     
       24. The method of  claim 23 , wherein the harmful information blocking code module intercepts at least one of network packet input/output routines to inspect the network packet input/output. 
     
     
       25. A method for blocking harmful information, the method comprising:
   receiving a request from a web server connected to a client system;        transmitting a harmful information blocking code module to the client system;        wherein the harmful information blocking code module runs on the client system to block in real time harmful information when the transmission of the harmful information blocking code module is completed, the harmful information blocking code module configured to:      inspect network packet input/output  ( I/O )  on the client system,        determine whether at least one of the packets transmitted to the inspected network packet I/O is harmful or not, and        block an internal process for supporting the network packet I/O, if any packet is determined to be harmful.       
     
     
       26. The method of  claim 25 , wherein the harmful information blocking code module intercepts at least one of network packet input/output routines to inspect the network packet input/output. 
     
     
       27. The method of  claim 25 , wherein the internal process comprises at least one of socket I/O routines. 
     
     
       28. The method of  claim 25 , wherein the packet comprises the header of a HTTP request message or a DNS lookup message. 
     
     
       29. The method of  claim 25 , wherein the harmful information blocking code module displays advertising contents in a separate window. 
     
     
       30. The method of  claim 25 , wherein the harmful information blocking code module is an object coded program linked to a web browser. 
     
     
       31. The method of  claim 30 , wherein the object coded program is ActiveX control, Java applet or Java script. 
     
     
       32. A method for blocking harmful information, the method comprising:
   sending a request to a web server connected to a client system;        downloading a harmful information blocking code module;        wherein the harmful information blocking code module automatically runs on the client system to block in real time harmful information when the downloading of the harmful information blocking code module is completed, the harmful information blocking code module configured to:      inspect file input/output  ( I/O )  on the client system by intercepting at least one of file I/O routines,        determine whether a file to be executed corresponding to the inspected file input/output is harmful or not, and        abort the execution of the file determined to be harmful.       
     
     
       33. The method of  claim 32  wherein the harmful information blocking code module is further configured to allow the execution of the file determined not to be harmful. 
     
     
       34. The method of  claim 32  wherein the harmful information blocking code module is further configured to treat the file determined to be harmful, if it can be treated. 
     
     
       35. The method of  claim 32  wherein the harmful information blocking code module is further configured to transmit the file to another web server, if the file determined to be harmful cannot be treated.