Symantec Corporation

Mark Spiegel

Bruce McCorkendale

William E Sobel

Shaun P Cooley

Paul Agbabian

Haik A Mesropian

David Kane

Patrick Gardner

John Millard

Edmund H White

David Buches

Basil S Gabriel

Melissa Mendonca

A computer-implemented method for securely managing file-attribute information for files in a file system may comprise: 1) identifying at least one file, 2) identifying file-attribute information that identifies at least one file attribute for the file, 3) identifying volatile metadata associated with the file that contains file-attribute information, 4) determining that the file has been modified, and 5) automatically deleting the volatile metadata. Corresponding systems and computer-readable media are also disclosed.

Methods and systems for securely managing file-attribute information for files in a file system

Threat emergence dates as well as file modification and scanning history are tracked to determine which files need to be scanned for possible infection by various attacking agents. Information concerning which scan engines are used to scan for the presence of different attacking agents is also tracked. Where given files only need to be scanned for a subset of all possible threats and the relevant scanning code resides in only a subset of all the scan engines, only the required scan engines are initialized, loaded or called in order to scan those files.

Threat emergence date scan optimization to avoid unnecessary loading of scan engines

A method and apparatus for mitigating the performance impact of background or idle time processing during interactive computing sessions. One embodiment of the present invention is a method for mitigating performance impact of background or idle time processing on interactive applications comprising identifying executable and data pages in physical memory that are associated with an interactive application that is temporarily unused and preventing any of the identified executable and data pages from paging out.

Method and apparatus for mitigating performance impact of background processing on interactive applications

Method and apparatus for mitigating performance impact of background processing on interactive application

A system and method are disclosed for detecting malicious computer applications. According to an embodiment of the present invention, it is determined whether a communication is attempting to occur, wherein the communication is associated with a first application. It is also determined whether there is a second application associated with the first application; and also determined whether the second application is trusted.

System and method for detecting malicious applications

A computer includes a filter module providing a standardized interface for intercepting file access requests. The computer also includes a cache manager that manages the caching mode used with the requests. An application on the computer issues a file access request and explicitly or implicitly specifies a cache hint informing the cache manager of a desired caching mode. A security scanner module scans files on the computer for malicious software. The security scanner module intercepts a file access request and alters the caching mode, if necessary, to one optimized for security scanning. The security scanner module performs the file scan using the optimal caching mode, and, if necessary, resets the caching mode to its original state.

Cache hint correction for security scanning

In the method of the present invention, an anti-virus scan of a file is performed in real time. A thread manager () detects () that an activity concerning a file has been initiated by a first thread. Responsive to the detection, the thread manager () determines () that a scan of the file should be conducted. The thread manager () initiates () the scan of the file by a second thread, thereby enabling the first thread to complete the activity concerning the file and to perform other tasks while the scan occurs. The thread manager () blocks () access to the file while the scan occurs.

Semi-synchronous scanning of modified files in real time

Computer implemented methods, apparati, and computer-readable media for quickly and safely opening computer files over a network. In a method embodiment of the present invention, a local computer () initiates a test open of a file () associated with a remote computer () that is coupled to the local computer () over the network (). When the test open discloses that the remote computer () has an acceptable malicious code scanning means (), the local computer () performs an actual open of the file ().

Opening computer files quickly and safely over a network

Methods, apparati, and computer program products for detecting and responding to fast-spreading network worm attacks include a network monitoring module (), which observes () failed network connection attempts from multiple sources. A logging module () logs () the failed connection attempts. An analysis module () uses the logged data on the failed connection attempts to determine () whether a sources is infected with a worm using a set of threshold criteria. The threshold criteria indicate whether a source's failed connection attempts are non-normal. In one embodiment, a response module () responds () to the computer worm by, e.g., alerting a user or system administrator, terminating an infected process (), or terminating the infected source's network access.

Growing community of inventors

West Hills, CA, United States of America

Mark Spiegel