Mcafee, Inc.

Other

Gregory William Dalcher

John Douglas Teddy

Jonathan Lewis Edwards

James Douglas Bean

Jeff Hetzler

Joel Robert Spurlock

Joe C Lowe

Hemang Satish Nadkarni

Peter Blaimschein

Oded Horovitz

Scott Clementson Elliott

Andrew Woodruff

Thomas C H Steiner

Thomas C H Steeiner

An opportunity to assist with remediation of a file at a remote particular host device is identified. One or more remediation techniques are identified that can be applied to assist with remediation of the file at the particular host device. In one aspect, one or more remediation scripts are identified from a plurality of remediation scripts for remediation of the file and provided to the particular host device for execution on the particular host device. In another aspect, a remediation tool is identified and launched on a computing device remote from the particular host device with operations of the remediation tool applied to resources of the particular host device. In another aspect, at least a portion of the remediation techniques are remotely initiated to be performed locally at the particular host device.

Remote malware remediation

A system, method, and computer program product are provided for conditionally preventing use of hardware virtualization. In use, an attempt to use hardware virtualization is identified. Further, the use of the hardware virtualization is conditionally prevented.

System, method, and computer program product for conditionally preventing use of hardware virtualization

A method is provided in one example embodiment that includes receiving in an external handler an event notification associated with an event in a virtual partition. A thread in the process in the virtual partition that caused the event can be parked. Other threads and processes may be allowed to resume while a security handler evaluates the event for potential threats. A helper agent within the virtual partition may be instructed to execute a task, such as collecting and assembling event context within the virtual partition, and results based on the task can be returned to the external handler. A policy action can be taken based on the results returned by the helper agent, which may include, for example, instructing the helper agent to terminate the process that caused the event.

System and method for virtual partition monitoring

A system, method, and computer program product are provided for conditionally performing an action based on an attribute. In use, at least one attribute associated with an object is determined. Additionally, an event associated with the object is identified. Further, at least one action is conditionally performed in association with the event, based on the at least one attribute.

System, method, and computer program product for conditionally performing an action based on an attribute

A system, method and computer program product are provided. In use, execution of a portion of internal code of an interface is identified. Further, in response to the execution of the portion of internal code, at least one aspect of an invocation of the interface is monitored and/or analyzed.

System, method, and computer program product for monitoring and/or analyzing at least one aspect of an invocation of an interface

A system, method, and computer program product are provided for monitoring an execution flow of a function. In use, data associated with a function is identified within a call stack. Additionally, a call stack frame is determined from freed memory in the call stack. Further, an execution flow of the function is monitored, utilizing the call stack frame from the freed memory.

System, method, and computer program product for monitoring an execution flow of a function

A system, method and computer readable medium pertaining to evaluation of events from a computer system to assess security risks to that system. Events are evaluated according to the aspects of each event and the aspects are used to make a preliminary determination regarding violation of a security rule. In addition to a preliminary determination of a rule violation, exceptions to the rule may be identified.

Automated local exception rule generation system, method and computer program product

Technologies for assembling an execution profile of an event are disclosed. The system and method may include recording a plurality of branch records, generating a first test event substantially identical to the event, verifying legitimacy of an owner of a code segment associated with the event, establishing an initial point of an execution chain associated with the event, establishing a final point of the execution chain associated with the event, analyzing branch records for an address associated with the code segment, installing a plurality of primary monitors within the execution chain associated with the event, and triggering the plurality of primary monitors.

Execution profile assembly using branch records

A host-based antimalware client can interface with a server-based antimalware support server. A file is identified at a host device. It is determined whether local reputation data for the file is available at the host device for the file. A query is sent to an antimalware support system relating to the file. Particular reputation data is received from the antimalware support system corresponding to the query. It is determined whether to allow the file to be loaded on the host device based at least in part on the particular reputation data.

Server-assisted anti-malware client

A system, method, and computer program product are provided for identifying unwanted data based on an assembled execution profile of code. In use, an execution profile of code is assembled by tracking interface usage of the code. Further, it is determined whether the code is associated with unwanted activity, based on the execution profile.

System, method, and computer program product for identifying unwanted data based on an assembled execution profile of code

A system, method, and computer program product are provided for controlling loading of an operating system, including mounting an image of an operating system in a pre-boot environment of a programmable device, identifying an untrusted component of the operating system registered to be automatically loaded or loaded during a boot-up stage of the operating system that is predetermined to be early, and substituting a trusted component for the untrusted component.

System, method, and computer program product for mounting an image of a computer system in a pre-boot environment for validating the computer system

A behavioral tracking system, method, and computer program product are provided for undoing events based on user input. In use, a plurality of unclassified events is identified on a system utilizing behavioral tracking. Additionally, input associated with at least one of the unclassified events is received from a user of the system for classifying the at least one of the unclassified events as an unwanted event. Further, the at least one unwanted event is undone in response to the receipt of the input.

Behavioral tracking system, method, and computer program product for undoing events based on user input

An antimalware support system is provided to support one or more host-based antimalware clients. A query is received from a particular host device that identifies a file detected by an antimalware tool local to the particular host device. Reputation data is determined for the file, and a response to the query is sent to the particular host device. The query response includes the reputation data determined for the file.

Growing community of inventors

Tigard, OR, United States of America

Gregory William Dalcher