Mcafee, Inc.

Networks Associates Technology, Inc.

Networks Associates, Inc.

Dmitry O Gryaznov

Igor G Muttik

Chengi Jimmy Kuo

Viatcheslav Peternev

Victor Kouznetsov

Khai Nhu Pham

Ivan Alexandrovich Teblyashkin

Michael Chin-Hwan Pak

Andrei Ouchakov

A system, method, and computer program product are provided for automatically identifying potentially unwanted data as unwanted. In use, data determined to be potentially unwanted (e.g. potentially malicious) is received. Additionally, the data is automatically identified as unwanted (e.g. malicious). Furthermore, the data is stored for use in detecting unwanted data (e.g. malicious data).

System, method, and computer program product for automatically identifying potentially unwanted data as unwanted

A method, system, and computer program product for identifying files that are found during a malware scan, thus enabling them to be excluded from further analysis. A method for handling a potential malware file comprises the steps of scanning a plurality of files to identify at least one file as potential malware, querying a database to determine whether the at least one file is known, and handling the at least one file based on whether the at least one file is known.

Known files database for malware elimination

A system, method, and computer program product are provided for performing an analysis on a plurality of portions of potentially unwanted data each requested from a different device. In use, a detection of potentially unwanted data (e.g., potentially malicious data) is identified based on a first analysis. Additionally, receipt of a plurality of portions of the potentially unwanted data is requested, where each of the plurality of portions is requested from a different device. Further, a second analysis is performed on the plurality of portions of the potentially unwanted data for determining whether the potentially unwanted data is unwanted (e.g., malicious).

System, method, and computer program product for performing an analysis on a plurality of portions of potentially unwanted data each requested from a different device

Virus fingerprint data is automatically generated for use in detecting computer viruses and virus removal data for use in removing computer viruses from infected files. The fingerprint generation technique serves to identify the infected virus carrying portions of a computer file and then search within those portions for matching blocks of bytes in excess of a certain size that are consistently located at a predetermined position within the infected computer file such that they may be used to reliably detect that computer virus when it is infecting different host computer files. The removal data generation mechanism serves to search the infected computer file against a clean version of that computer file to identify matching blocks. Critical data missing within the infected computer file may be found within the virus carrying portions by the application of various decryption techniques. Cutting points to remove the virus carrying portions are identified. The fingerprint data and the removal data are tested on pairs of clean and infected computer files to verify that they operate correctly.

Automatic builder of detection and cleaning routines for computer viruses

A macro virus definitions database is maintained and includes a set of indices and associated macro virus definition data files. One or more of the macro virus definition data files are referenced by the associated index. Each macro virus definition data file defines macro virus attributes for known macro viruses. The sets of the indices and the macro virus definition data files are organized according to macro virus families. One or more strings stored in a suspect file are compared to the macro virus attributes defined in the one or more macro virus definition data files for each macro virus family in the macro virus definitions database. The macro virus family to which the suspect file belongs is determined from the indices for each of the macro virus definition data files at least partially containing the suspect file.

System and method for identifying a macro virus family using a macro virus definitions database

A method, system, and computer program product for providing monitoring and interception of malwares in Internet Relay Chat (IRC), which is secure, does not require significant system resources, and is capable of monitoring multiple IRC networks and servers. A method of detecting a computer malware comprises the steps of joining an Internet Relay Chat server, retrieving a list of channels of the Internet Relay Chat server, monitoring at least one channel in the list of retrieved channels, accepting data received from the monitored channel, and storing and logging the data received from the monitored channel.

Automated Internet Relay Chat malware monitoring and interception

A method, system, and computer program product that provides multiple names of a given malware in a quick and automated fashion. A method of providing names of computer malwares comprises the steps of receiving a sample of a computer malware, scanning the computer malware using a plurality of anti-virus scanners, at least some of the anti-virus scanners generating information identifying the computer malware, and compiling the generated information identifying the computer malware. The information identifying the computer malware may.

Method and system for providing computer malware names from multiple anti-virus scanners

A system, method and computer program product are provided for protecting a computer in an opened share mode. Initially, a computer is run on a network in an opened share mode. In operation, attempts to access the computer by applications are monitored. Further, it is determined whether the applications attempt to modify the computer. A security event is then executed in response to any attempt to modify the computer.

Virtual opened share mode system with virus protection

A system and a method for performing partitioned scanning of a dataset for malware in a distributed computing environment is disclosed. A dataset is maintained in a plurality of structured databases in the distributed computing environment. Each database stores a plurality of data item groups which each include a plurality of individual data items. Each such data item is uniquely identified within the dataset by a data item identifier. A set of indices is stored in a centralized database. The set of indices includes a list of scanned data item identifiers for each data item within the dataset scanned for malware and a list of last entry numbers for each data item group stored in each database. Each last entry number corresponds to one such data item within the data item group last scanned for malware. A plurality of malware scanners are executed in substantial concurrency. For each malware scanner, one such database and each such data item group within the selected database having data items not appearing in the list of last entry numbers are selected. Each such data item having a data item identifier not appearing in the list of scanned data item identifiers is obtained. Each such obtained data item is scanned for malware.

System and method for partitioned distributed scanning of a large dataset for viruses and other malware

A system and method for executing computer virus definitions containing general purpose programming language extensions is described. One or more virus definition records are stored in a computer virus data file. Each virus definition record includes an identifier, a virus detection section and an extension sentence. The identifier uniquely identifies a computer virus. The virus detection section includes object code providing operations to detect the identified computer virus within a computer system. The extension sentence includes object code providing reusable operations implemented in a general purpose computing language. For each virus definition record, at least one of the object code of the virus detection section and the extension sentence is interpreted.

Growing community of inventors

Portland, OR, United States of America

Dmitry O Gryaznov