Ao Kaspersky Lab

Kaspersky Lab, Zao

Alexander A Romanenko

Oleg Ishanov

Anton S Lapushkin

Yuri G Slobodyanuk

Mikhail A Pavlyushchik

Vladimir A Kuskov

Oleg V Kupreev

Vyacheslav V Zakorzhevsky

Alexander A Stroykov

Alexander V Amrilloev

Sergey V Dobrovolsky

Oleg A Yurzin

Yury G Parshin

Oleg A Ishanov

Disclosed are systems and methods for preserving of data saved on a data storage device. An assessment is made as to the degradation of the data storage device, during which a determination is made of the rate of degradation and the probability of failure of the data storage device. When the probability is greater than a given threshold, the damaged sectors of the data storage device are identified by scanning of the surface of the data storage device. A worth grade (i.e., the value of the saved data to the user) is determined at least for data in sectors close to the damaged sectors on the basis of an analysis of at least the meta-data of the data. A decision is made as to the possible loss of data, and a backup copy is created based on the worth grade of the data and the rate of degradation of the data storage device.

System and method of assessing and managing storage device degradation

Disclosed are a system and method for determining web pages modified with malicious code. An example method includes: intercepting an attempt to access a website; selecting, by a processor, one or more malicious software configuration files based on the intercepting of the attempt to access the website; creating a verification web page based on one or more code fragments from the selected one or more malicious software configuration files; opening the verification web page; and determining, by the processor, whether malicious code has been injected into the opened verification web page.

System and method for determining web pages modified with malicious code

Disclosed are systems and methods for controlling execution of programs on a computer. An exemplary method includes detecting an unknown program installed on a computer; identifying undesirable actions performed by the unknown program on the computer, wherein the undesirable actions include at least one of: actions performed by the program without knowledge of a user, actions for accessing personal user data on the computer, and actions effecting user's working with other programs or operating system of the computer determining whether the unknown program is undesirable or not based on the identified undesirable actions of the program; when the unknown program is determined be undesirable, prompting the user to select whether to allow or prohibit execution of the undesirable program on the computer; and when the unknown program is determined not to be undesirable, allowing execution of the unknown program on the computer.

System and method of preventing execution of undesirable programs

Disclose are system, method and computer program product for detection of malware on a user's computing device. An exemplary method comprises: detecting, by an antivirus application executing of the user's computing device, that an antivirus record is activated on the computing device for detecting a maliciousness of a software object, the antivirus record having a selected status indicator indicating at least one of: a working record, a test record, or an inactive record; in response to detecting the antivirus record having working or test status, checking, by the antivirus application, for a correction of the antivirus record with an antivirus server, wherein said correction includes a change in the status of the antivirus record; in response to receiving from the antivirus server the correction of the antivirus record, using by the antivirus application said correction for processing of the software object.

System and method for detection of malware on a user device using corrected antivirus records

Disclosed is a system and method for restoring modified data. An example method includes intercepting, by an activity tracking module, a request from a program to modify data; determining, by an analysis module, parameters of the intercepted request; generating, by the analysis module, a request to generate a backup copy of the data based on at least one of the determined parameters of the intercepted request; and generating and storing, by a backup module, the backup copy of the data in an electronic database.

System and method of restoring modified data

Disclosed is a system and method for determining modified web pages. An example method includes: extracting a plurality of malware trigger code fragments from a configuration file of the malicious software; creating a verification web page by adding the plurality of malware trigger code fragments into a template page; storing, in a database, data relating to an initial state of the verification web page; opening the verification web page and identifying data relating to an opened state of the verification web page; comparing the data relating to the initial state and the data relating to the opened state of the verification web page; and based on detected differences between the data relating to the initial state and the data relating to the opened state of the verification web page, identifying at least one modified code fragment of the verification web page.

System and method for determining modified web pages

Disclosed are systems and methods for controlling installation of programs on a computer. An exemplary system is configured to detect installation of an unknown program on a computer; suspend installation of the unknown program; execute the unknown program in a secure environment; detect undesirable actions of the unknown program, including: actions performed by the program without knowledge of a user, actions for accessing personal user data on the computer, and actions effecting user's working with other programs or operating system of the computer; determine whether the unknown program is undesirable or not based on the detected undesirable actions of the program; when the unknown program is determined be undesirable, prompt the user to select whether to allow or prohibit installation of the undesirable program on the computer; and when the unknown program is determined not to be undesirable, allow installation of the unknown program on the computer.

System and method of preventing installation and execution of undesirable programs

Disclose are system, method and computer program product for correcting antivirus records. In an example aspect, an antivirus application receives a software object for malware detections using an antivirus database and an antivirus cache. The antivirus database comprising antivirus records and the antivirus cache comprising corrections of the antivirus records. The antivirus application determines that software objection is malicious by activating an antivirus record based on information in the antivirus database or the antivirus cache. The antivirus application transmits information relating to the antivirus record to a server prior to executing actions associated with the antivirus record in response to detecting a selected status indicator of the antivirus record. The antivirus application then receives a correction of the antivirus record from the server for processing the software object.

System and method for correcting antivirus records using antivirus server

Disclose are system, method and computer program product for correcting antivirus records. In an example aspect, an antivirus application analyzes a software object for a presence of malware. The antivirus application includes an antivirus database and an antivirus cache. The antivirus application retrieves from the antivirus database an antivirus record associated with the analyzed object. The antivirus record indicates whether the object is clean or malicious and further includes at least a test antivirus record status indicator. The antivirus application checks at least in the antivirus cache for correction of the test antivirus record. The correction includes a change in the test status of the antivirus record. When a correction for the retrieved antivirus record is found in the antivirus cache, the antivirus application uses said correction for the antivirus record for a further processing of the software object.

System and method for correcting antivirus records and using corrected antivirus records for malware detection

Disclose are system, method and computer program product for correcting antivirus records. In an example method, during analysis of a software object for malware, an antivirus application retrieves from an antivirus database an antivirus record associated with the analyzed object, which identifies the object as malicious or clean. The application also checks if there is a correction for the antivirus record in an antivirus cache and use the correction for analysis of the software object. If no correction is found in the cache, the application checks correctness of the antivirus record with an antivirus server. The antivirus server uses statistical information about software objects collected from antivirus applications deployed on different computers to validate correctness of antivirus records. If the antivirus server provides a correction for the antivirus record, the application uses the provided correction for analysis of the software object for malware.

Growing community of inventors

Moscow, Russia

Alexander A Romanenko