Mcafee, Inc.

Symantec Corporation

Symantec Operating Corporation

Prabhat Kumar Singh

Nitin Jyoti

Gangadharasa Srinivasa

Palasamudram Ramagopal Prashanth

Jeffrey Green

Angshuman Bezbaruah

Sven Krasser

Ankur P Panchbudhe

Sree Hari Nagaralu

Guy William Welch Roberts

Sujit Magar

Abhijit V Limaye

Anand Bodke

Zhenyu Zhong

Romanch Agarwal

Harinath Ramachetty Vishwanath

A file stored in a first portion of a computer memory of a computer is determined to be a malicious file. A duplicate of the file is stored in a quarantine area in the computer memory, the quarantine area being in a second portion of the computer memory that is different from the first portion of the computer memory. One or more protection processes are performed on the file. The determination that the file is a malicious file is determined to be a false positive and the file is restored, during a boot sequence, to a state prior to the one or more protection processes being performed on the file.

Rollback feature

A method and apparatus for analyzing end user license agreements and taking action based on the analysis outcome. In one embodiment, the method includes sensing initialization of an installable software program installation, extracting a EULA from the installable during installation, pausing presentation of the EULA to a user, providing a database of suspect terms, analyzing whether a suspect term exists in the EULA, and presenting at least one of the EULA or a suspect term to the user.

Method and apparatus for analyzing end user license agreements

Method, apparatus, and computer readable medium for detecting malware on a target computer system is described. A threat profile is obtained at the target computer, the threat profile having manifestation information for known malware, the manifestation information including effects of the known malware on computer systems infected by the known malware. Using the threat profile, at least a portion of the manifestation information is detected on the target computer. A confidence level for detection of potential malware is determined based on the at least a portion of the manifestation information detected. The potential malware on the target computer is convicted as malware for remediation if the confidence level satisfies a threshold confidence level.

Method and apparatus for detecting malware on a computer system

Systems and methods for detecting malicious processes in a non-signature based manner are disclosed. The system and method may include gathering features of processes running on an electronic device, applying a set of rules to the features, and applying a statistical analysis to the results of the rules application to determine whether a process should be classified into one or more of a plurality of process categories.

System and method for non-signature based detection of malicious processes

A method and apparatus for preventing data leakage of e-discovery data items is provided. In one embodiment, the method for automatically configuring e-discovery data for data leakage prevention includes processing filtering information regarding at least one e-discovery data item that is selected for data leakage prevention and generating data leakage prevention information for the selected at least one e-discovery data item, wherein the data leakage prevention information is used to filter the at least one data item.

Method and apparatus for preventing data leakage of e-discovery data items

A method for providing malware cleaning includes detecting potential malware on a first device connected to a network. A request including information to allow a second device connected to the network to determine an appropriate cleaning response is sent from the first device to the second device over the network. Upon receiving the request, the second device attempts to identify an appropriate cleaning response and, if a response is identified, sends the cleaning response over the network to the first device. The cleaning response is usable by the first device to address the detected potential malware.

Dynamic cleaning for malware using cloud technology

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for rolling back protection processes. In one aspect, a method includes determining that a file is a malicious file, storing a duplicate of the file in a quarantine area, performing one or more protection processes on the file, if the determination that the file is a malicious file is a false positive determination, restoring the file by a pre-boot rollback process to a state prior to the one or more protection processes performed on the file, and booting the computer with the restored file, and if the determination that the file is a malicious file is not a false positive determination, not restoring the file to a state prior to the one or more protection processes performed on the file, and booting the computer.

A system, method, and computer program product are provided for segmenting a database based, at least in part, on a prevalence associated with known objects included in the database. In operation, a database including a plurality of known objects is identified. Additionally, the database is segmented into a plurality of segments. Furthermore, each of the plurality of known objects are assigned to one of the plurality of segments, based at least in part on a prevalence associated with each of the plurality of known objects.

System, method, and computer program product for segmenting a database based, at least in part, on a prevalence associated with known objects included in the database

Growing community of inventors

Bengaluru, India

Prabhat Kumar Singh