Mcafee, Inc.

Neil Andrew Cowie

Igor G Muttik

Daniel Joseph Wolff

Paul Nicholas Gartside

Lee Codel Lawson Tarbotton

Ivan Alexandrovich Teblyashkin

A technique for detecting Trojans and worms within packed computer files uses fingerprint data derived from the unpacked resource data associated with the packed computer files. The number of entries, the position within the resource data and size of the resource that is the largest resource specified, a timestamp value of compilation and a checksum value derived from the whole of the resource data may be included within a fingerprint value as characteristic of a particular set of resource data. A library of such fingerprint values may be generated for known Trojans and worms, or other programs it is wished to detect, and then a suspect file compared against this library of fingerprints.

Detecting computer programs within packed computer files

Malware definition data for mobile computing devicesis generated from master malware definition databy selecting those classes of malware threat to which the mobile computing device is vulnerable and then selecting the matching malware items from within the master malware definition data. A PCto which the mobile computing device may be connected is responsible for downloading an updated version of the master malware definition data for its own use and generates appropriate mobile computing device malware definition data for transfer to the mobile computing device when it is connected to the PC. The scanner programs of both the PC and the mobile computing device may be similarly updated.

Generating malware definition data for mobile computing devices

When a user commands execution of a computer program to commence, a loader programis first started. This loader programreads an encrypted version of the computer programand decrypts it using a public key. This generates an executable version of the computer programwhich is written directly to the computer memory. When the loader programhas decrypted the whole of the computer programit starts execution of the computer programit has written into the computer memoryand terminates itself or is terminated by the computer program it started. The computer programwritten into the computer memorywill be written into its own memory space and will have its own execution thread. The encryption used may be public key/private key encryption.

Initiating execution of a computer program from an encrypted version of a computer program

A system, method and computer program product are provided for preventing writes to critical files. Initially, factors associated with a computer are identified. Then, requests to write to files on the computer are monitored. The writes to the files on the computer are conditionally prevented based on the factors to prevent virus proliferation. In use, the factors are altered based on the monitoring of the requests.

System, method and computer program product for precluding writes to critical files

A system, method and computer program product are provided for detecting viruses in software. Initially, data is compared with a plurality of virus definitions in a first database. If the data is successfully compared with at least one of the virus definitions, a security event is executed. The data is then compared with fingerprints of innocent data in a second database. If the data is successfully compared to the fingerprints of innocent data, access to the data is permitted. If, however, the data is unsuccessfully compared to the virus definitions and the fingerprints of innocent data, information is transmitted over a network for analysis purposes.

Growing community of inventors

Aylesbury, United Kingdom

Neil Andrew Cowie