Ao Kaspersky Lab

Kaspersky Lab, Zao

Ap Kaspersky Lab

Kaspersky Lab Ao

Konstantin Y Manurin

Andrey V Sobko

Oleg V Zaitsev

Olga E Domke

Mikhail A Levinsky

Vladimir Strogov

Vyacheslav Levchenko

Disclosed are system and method for executing calls to a file system of a computer. An exemplary method comprises intercepting, by a software agent, a call to the file system; determining one or more parameters of the call that identify its functionality; determining a priority of executing the call based on the one or more parameters; storing information about the call, the parameters and the priority into a database; selecting from the database, one or more calls for execution based at least in part on relative priorities of execution of the plurality of calls stored in the database; determining whether to execute or not to execute a selected call based on whether the selected call interferes with execution of an earlier selected call; and when the selected call does not interfere with execution of an earlier selected call, passing the selected call to the file system for execution.

System and method for executing calls from OS process to file system

Disclosed are systems and methods for generating rules for detecting modified or corrupted external devices connected to a computer system. An exemplary method includes analyzing data associated with the external device connected to the computer system based on stored data associated with one or more other devices; identifying at least one anomaly associated with the analyzed data that indicates the detected external device is modified or corrupted; generating at least one rule in response to the identified anomaly, wherein the at least one rule is based on the external device; and storing the at least one rule in a database accessible to the computer system.

System and method for generating rules for detecting modified or corrupted external devices

Disclosed are systems and methods for detecting modified or corrupted external devices connected to a computer system. An exemplary method includes storing in a database, data that relates to devices previously connected to the computer system and rules that specify conditions that indicate when the device should be further analyzed as being possibly corrupted. The method further includes receiving from the device data that relates to the device or to a connection between the device and the computer system; performing an analysis of the received data by comparing the received data and the stored data relating to devices previously connected to the computer system; and applying results of the analysis of the received data to the rules to determine whether the at least one condition is satisfied that indicates that the device is possibly modified or corrupted and should be further analyzed for presence of malware.

System and method for detecting modified or corrupted external devices

A system and method for optimizing a process of synchronization of a database of files checked by an anti-virus (AV) application implemented as a special AV driver. The database is updated by a special interface application using a log file and the AV driver cache. The AV driver monitors modifications of the files and records modification-related information in the context of the modified files. The AV driver creates and maintains a log of modified files. The AV driver supports a circular cache containing minimal required information about the modified files. This information is used for identification of the modified files by an application providing an interface between the AV driver and the database of checked files.

System and method for optimization of anti-virus scan

Method and system for optimization of anti-virus scan

Growing community of inventors

Moscow, Russia

Konstantin Y Manurin