Symantec Corporation

Patrick Gardner

Sourabh Satish

Mark Kevin Kennedy

Adam Glick

Spencer Dale Smith

Everett J Lai

Michael Spertus

Haik A Mesropian

Shane Pereira

Pieter Viljoen

David Kane

Mark Spiegel

David Buches

Alexander Danileiko

Peter Linhardt

Tim Naftel

John Meade

Richard Gough

A computer-implemented method for securely managing file-attribute information for files in a file system may comprise: 1) identifying at least one file, 2) identifying file-attribute information that identifies at least one file attribute for the file, 3) identifying volatile metadata associated with the file that contains file-attribute information, 4) determining that the file has been modified, and 5) automatically deleting the volatile metadata. Corresponding systems and computer-readable media are also disclosed.

Methods and systems for securely managing file-attribute information for files in a file system

A DNS security system collects and uses aggregated DNS information originating from a plurality of client computers to detect anomalous DNS name resolutions. A server DNS security component receives multiple transmissions of DNS information from a plurality of client computers, each transmission of DNS information concerning a specific instance of a resolution of a specific DNS name. The server component aggregates the DNS information from the multiple client computers. The server component compares DNS information received from a specific client computer concerning a specific DNS name to aggregated DNS information received from multiple client computers concerning the same DNS name to identify anomalous DNS name resolutions. Where an anomaly concerning received DNS information is identified, a warning can be transmitted to the specific client computer from which the anomalous DNS information was received.

Using aggregated DNS information originating from multiple sources to detect anomalous DNS name resolutions

A computer-implemented method for blocking and removing Internet-traversing malware may include: 1) identifying a persistent storage object of an Internet client application, 2) identifying an attempt by an executable object to access the persistent storage object, 3) determining that the executable object is not authorized to access the persistent storage object, and then 4) performing a security action based on the determination. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for blocking and removing internet-traversing malware

Incoming network traffic is monitored, and content-based files in the monitored incoming network traffic originating from remote sources are identified. When a specific content-based file originating from a remote source is identified, security information concerning that file is gleaned. This security information comprises at least a security reputation of the remote source from which the file originates. An attempt to open the file is identified, and a security risk rating is determined based on the security information concerning the file. In response to the security risk rating exceeding a given threshold, behavior associated with the attempt to open the file is altered. This altering of behavior can comprise, for example, disabling a scripting engine for the instance of the content processing application attempting to open the file, or altering file system and/or operating system resource access privileges.

Altering application behavior based on content provider reputation

A computer-implemented method for individually managing the power usage of software applications may include: 1) identifying at least one software application installed on a computing device, 2) determining the power usage of the software application, 3) identifying a power-management policy for managing the power usage of the software application independent of the overall power usage of the computing device, and then 4) managing the power usage of the software application independent of the overall power usage of the computing device in accordance with the power-management policy. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for individually managing the power usage of software applications

A computer system detects and selectively blocks a cookie associated with a website. The system monitors a network traffic stream directed to a client from a website and detects presence of a cookie associated with the website in the network traffic stream. The system detects the cookie in the network traffic stream by analyzing the network stream using a network traffic filtering scheme, such as a deep packet inspection engine. The system further determines a reputation of the website in response to detecting the cookie in the network traffic stream. A reputation of a website represents an assessment of whether the website is trustworthy. Based on the determined reputation of the website, the system selectively blocks the cookie from being stored in the client if the reputation of the website is bad.

Using URL reputation data to selectively block cookies

A computer-implemented method includes identifying a file and calculating a first identifier for the file. The method may also include identifying a first malware identifier that is associated with a first malware program. The method may further include comparing the first file identifier with the first malware identifier to determine whether the file comprises the first malware program. The method may include saving the first file identifier in a manner that allows the first file identifier to be retrieved for comparison with a second malware identifier. The second malware identifier may be associated with a second malware program. Various other methods and systems are also disclosed herein.

Methods and systems for scanning files for malware

A user mode application component invokes the assistance of a kernel mode driver component to detect and/or remediate malicious code on a computer system. The user mode application may include code that detects, for example, spyware and computer viruses, from user mode and when appropriate takes protective action when malicious code is detected. In one aspect, when the user mode application is unable to perform a selected operation in attempting to detect and/or take protective action, the user mode application invokes a kernel mode driver for assistance. The kernel mode driver assists user mode application in detecting malicious code and/or taking protective action by enabling or otherwise performing a selected operation for the user mode application.

Method using kernel mode assistance for the detection and removal of threats which are actively preventing detection and removal from a running system

A network communication corresponding to a malicious network signature associated with malicious code is detected on a host computer system. A determination is made whether or not the malicious network signature is validated as associated with a non-malicious code process. Upon a determination that the malicious network signature is not validated, the corresponding network communication is blocked, and the associated malicious code is located on the host computer system and removed from the host computer system. In some embodiments, the host computer system is further evaluated for the presence of residual artifacts of the malicious code on the host computer system.

Method for malware removal based on network signatures and file system artifacts

A method and apparatus of detecting executable software in alternate data streams to secure operation of a computer comprises processing information regarding a file requested for execution and determining an alternate data stream associated with the file, wherein the alternate data stream comprises executable software.

Method and apparatus for detecting executable software in an alternate data stream

A method for mitigating false-positives as detected by antivirus software comprising accessing an operating system file that has been identified as malware; creating a signature for the operating system file; comparing the created signature to a signature database; and, if the created signature is not found in the signature database, defining the operating system file as malware. An operating system file, as used herein, is any file included as a part of the operating system binary executable file set, as well as any files added from third party vendors that integrate with or plug into the operating system.

Method for mitigating false positive generation in antivirus software

Upon detection of a rootkit, a host computer system is rebooted. The boot process is interrupted. Access to a media, e.g., a volume or disk, containing the rootkit is gained and the media is directly accessed. The rootkit is disabled, e.g., renamed or deleted, and the host computer system is rebooted a second time. If the rootkit has not been previously removed, e.g., only renamed, the rootkit is removed, e.g., using a conventional antivirus application. Thus, upon detection of a rootkit, the rootkit is removed without a clean boot.

Growing community of inventors

Northridge, CA, United States of America

Patrick Gardner