Mcafee, Inc.

Kevin Andrew Gudgion

Lee Codel Lawson Tarbotton

Lokesh Kumar

Nicholas Paul Kelly

Dirk Kolberg

Lukesh Kumar

Dirk Kollberg

A system, method, and computer program product are provided for simulating at least one of a virtual environment and a debugging environment to prevent unwanted code from executing. In use, at least one of a virtual environment and a debugging environment is simulated. Additionally, unwanted code is prevented from executing as a result of the simulation.

System, method, and computer program product for simulating at least one of a virtual environment and a debugging environment to prevent unwanted code from executing

An anti-virus system provider distributes an e-mail identifying content filtering rule seeking to identify e-mail messages suspected of containing an item of malware from a central source () to users (). This distribution may be by an e-mail message itself which is appropriately signed and encrypted. At the user system (), the received e-mail identifying content filtering rule is extracted from the e-mail message and added to the content filtering rules () being applied within that user system. In this way, malware which is distributed by e-mail may be identified by characteristics of its carrier e-mail rather than characteristics of the malware itself which not yet have been properly analyzed or the mechanisms for detecting such characteristics of the malware itself not yet put in place.

Detecting malware carried by an E-mail message

Detecting malware carried by an e-mail message

The present invention provides a computer program product, method and data processing apparatus for reviewing files for potential malware. The computer program product comprises logging code operable to maintain a statistical log having an entry for each file sent for review, each entry being arranged to store a count value indicating the number of times that the file has been sent for review and a value of one or more predetermined attributes relating to the file. Weighting table code is also used to maintain a weighting table identifying, for each value of said one or more predetermined attributes, a weighting indicating the likelihood that a file having that value of the one or more predetermined attributes will be malware. The computer program product further comprises statistical log interface code operable, upon receipt of a file, to determine with reference to the statistical log the count value relating to that file, and action determination code operable, if the count value determined by the statistical log interface code exceeds a predetermined threshold, to reference the weighting table to determine the weighting to be associated with the file, based on the value of said one or more predetermined attributes associated with that file in the statistical log. Finally, action performing code is provided to perform predetermined actions in relation to the file depending on the weighting determined by the action determination code. It has been found that this technique is useful in identifying files that may potentially contain malware.

Controlling access to suspicious files

Growing community of inventors

Milton Keynes, United Kingdom

Kevin Andrew Gudgion