Patent ID: 7386888

Claim:
In a distributed network having a number of server computers and associated client devices, method of isolating infected client devices from uninfected client devices and of inoculating the infected devices, comprising: correlating network related virus infection reports of virus attacks; when a specific number of reports have been correlated, determining if a virus outbreak has occurred based on the correlated information wherein an outbreak has occurred when the number of occurrences of a specified virus has surpassed a threshold; isolating infected client devices from uninfected client devices when the virus outbreak is confirmed; copying by a traffic controller substantially all data packets included in the network traffic; and forwarding the copied data packets to a virus analyzer unit; a controller signaling a virus monitor to switch to inline mode where all data packets are checked for the virus and related viruses without copying of the data packets; monitoring all data packets in the network for the virus; identifying the virus; blocking only packets infected by the particular virus; creating an anti-virus agent, wherein creating an anti-virus agent further includes: parsing the virus into 1) a detection module that identifies a selected one of the client devices as a target client device, 2) an infection module that causes the virus to infect the target client device not infected by the selected virus, and 3) a viral code payload module that infects the target client device; analyzing the infection module to determine the method of infection and the anti-viral payload module to determine the deleterious effects; modifying the infection module to infect client devices already infected by the virus; incorporating the anti-virus into the payload module that acts to prevent further infection by the virus; and forming an anti-computer virus agent by combining the detection module, the modified infection module, and the modified viral payload module.