Mcafee, Inc.

Networks Associates Technology, Inc.

Lee Codel Lawson Tarbotton

Daniel Joseph Wolff

Kevin Andrew Gudgion

Nicholas Paul Kelly

Paul Nicholas Gartside

Oliver G Devane

Chris Barton

Guy William Welch Roberts

Robert Edward Moore

Igor G Muttik

Fraser Peter Howard

James Malcolm Vignoles

Graham Arthur Makinson

Christopher Barton

Neil Andrew Cowie

Alexander James Hinchliffe

Martin James Lucas

Federico Barbieri

Andrew John Peter Bidgood

Carl Steven Botterill

Sonali Agarwal

Timothy James Page

Edward Moore

Trevor Hugh Rice

There is disclosed in one example a computing apparatus, including: a processor and a memory; instructions encoded within the memory to instruct the processor to: identify a downloaded file on a file system; inspect a metadata object attached to the downloaded file; parse the metadata object to extract an advertiser identification string from a GET code portion of a uniform resource locator (URL); query a reputation cache for a reputation for the advertiser identification string; receive a deceptive reputation for the advertiser identification string; and take a remedial action against the downloaded file.

Mitigation of deceptive advertisements

A method in one example implementation includes selecting at least one criterion for controlling data transmission from within a virtual machine. At least one application is included within the virtual machine, which includes a policy module. The selected criterion corresponds to at least one policy associated with the policy module. The method also includes evaluating the selected criterion of the policy to permit an attempt to transmit the data from within the virtual machine. In more specific embodiments, the policy may include a plurality of criteria with a first selected criterion permitting transmission of the data to a first application and a second selected criterion prohibiting transmission of the data to a second application. In another specific embodiment, the method may include updating the policy module through an administration module to modify the selected criterion.

System and method for preventing data loss using virtual machine wrapped applications

A system, method, and computer program product are provided for detecting unwanted data based on an analysis of an icon. In use, an icon is analyzed. Furthermore, unwanted data is detected based on the analysis.

System, method, and computer program product for detecting unwanted data based on an analysis of an icon

An anti-virus system provider distributes an e-mail identifying content filtering rule seeking to identify e-mail messages suspected of containing an item of malware from a central source () to users (). This distribution may be by an e-mail message itself which is appropriately signed and encrypted. At the user system (), the received e-mail identifying content filtering rule is extracted from the e-mail message and added to the content filtering rules () being applied within that user system. In this way, malware which is distributed by e-mail may be identified by characteristics of its carrier e-mail rather than characteristics of the malware itself which not yet have been properly analyzed or the mechanisms for detecting such characteristics of the malware itself not yet put in place.

Detecting malware carried by an E-mail message

A method for defining an area to record changes made to a computer system is provided. A safe area is defined on a primary storage device of the computer system and information is stored on the location of the safe area on a secondary storage device. Further, the computer system is booted utilizing a backup device and data is changed on the primary storage device. The changes are recorded in the safe area of the primary storage device and are accessible when the computer system is booted from the backup device.

Method and system for defining a safe storage area for use in recovering a computer system

Detecting malware carried by an e-mail message

The present invention provides a computer program product, method and data processing apparatus for reviewing files for potential malware. The computer program product comprises logging code operable to maintain a statistical log having an entry for each file sent for review, each entry being arranged to store a count value indicating the number of times that the file has been sent for review and a value of one or more predetermined attributes relating to the file. Weighting table code is also used to maintain a weighting table identifying, for each value of said one or more predetermined attributes, a weighting indicating the likelihood that a file having that value of the one or more predetermined attributes will be malware. The computer program product further comprises statistical log interface code operable, upon receipt of a file, to determine with reference to the statistical log the count value relating to that file, and action determination code operable, if the count value determined by the statistical log interface code exceeds a predetermined threshold, to reference the weighting table to determine the weighting to be associated with the file, based on the value of said one or more predetermined attributes associated with that file in the statistical log. Finally, action performing code is provided to perform predetermined actions in relation to the file depending on the weighting determined by the action determination code. It has been found that this technique is useful in identifying files that may potentially contain malware.

Controlling access to suspicious files

A system, method and computer program product are provided for preventing writes to critical files. Initially, factors associated with a computer are identified. Then, requests to write to files on the computer are monitored. The writes to the files on the computer are conditionally prevented based on the factors to prevent virus proliferation. In use, the factors are altered based on the monitoring of the requests.

System, method and computer program product for precluding writes to critical files

An anti-computer virus system is used to enforce the banning of computer programs. A user is provided with a tool for creating their own banned computer program identifying data. The user-created data is then used to control the anti-virus system to identify banned computer programs and take appropriate banned computer program actions. The banned computer program identifying data can be encrypted with an organization's private PGP key such that it will only be capable of successful decryption and use upon computer systems within that organization bearing the corresponding public PGP encryption key.

Mechanisms for banning computer programs from use

A software audit system is provided in conjunction with an anti-virus system. A computer virus scan request received by the anti-virus system () is used to trigger an audit data generator () to generate audit data. The audit data generator () may also serve to ban certain computer programs from execution and monitor the concurrent usage of other computer programs.

Software audit system

An anti computer virus program uses a library of virus drivers that includes an indication of whether a particular virus can cause irreparable damage and data indicating enhanced user warnings and actions that might be associated with such viruses. If a detected computer virus is one that can cause irreparable damage, then an enhanced user warning () is issued indicating this to the user and a notification () of the possibility of such corruption is added into the repaired computer file. The notification may take the form of an electronically signed () banner message or the like.

User alerts in an anti computer virus system

Pre-emptive malware scanning of user specified operating systemdefined storage locations is performed to establish whether those storage locations contain any malware containing computer files. If the storage locations are malware-free, then they are classified as clean storage locations and subsequent read accesses to those storage locations will be permitted without requiring further malware scanning. Writes to clean storage locations will continue to be malware scanned.

Malware scanning to create clean storage locations

An event report, such as a virus detection event, is sent from a reporting computerto a receiving computervia an internet link. The report data may take the form of a URL requesting a web pageto be provided by the receiving computer, the URL bearing an encrypted formof the report data that is used to identify the requested web page as well as pass further information to the receiving computer. Alternatively, the report data may be collated in the reporting computerand passed to the receiving computerwhen a computer virus definition data update is requested. The report data seeks to uniquely identify the event by incorporating the MAC address of the reporting computer, the date, time, computer product identifier, version identifier, update identifier and driver triggered. Additionally, a checksum derived from the infected file together with an indication of the corrective action, if any, taken by the reporting computermay be included. The report data sent to the receiving computermay be used to obtain real life information concerning the prevalence of particular viruses together with information characterising the anti-virus programs and their update status being employed by the user community.

Event reporting between a reporting computer and a receiving computer

A computer file may be scanned for suspicious wordsoccurring within suspicious contexts. Thus, messages embedded by malware authors within their malware may be detected. The detection of such embedded messages may be used to identify otherwise unknown items of malware or as a pre-filtering technique for controlling the use of further scanning techniques.

Growing community of inventors

Leicester, United Kingdom

Lee Codel Lawson Tarbotton