Microsoft Technology Licensing, LLC

Sterling M Reasor

Eric R Flo

Christopher Andrew Evans

John E Brezak

Charles W Stabb

Giampiero M Sierra

Mark R Ligameri

Chris J Guzak

David Andrew Matthews

John Scott Stephens

Angela K Butcher

Raymond J Chen

Ramkumar Ramasubramanian

Dennis L Davis

Jason Alan Christensen

Craig Adam Beilinson

Santanu Chakraborty

Charles Cummins

Jason Garms

Cristian Marius Ilac

Timothy P McKee

J Craig Hally

Ravipal S Soin

Hillel Noah Cooperman

Sean Olin Blagsvedt

Louis Amadio

Mohammed Samji

Victor Tan

Klaus U Schutz

Eric C Perlin

Brian D Wentz

Kelly Elizabeth Rollin

Ahsan Syed Kabir

Frank Dominic Yerrace

Peyman Oreizy

Timothy Daniel Noonan

Kanwal Vedbrat

David Ruzyski

James H Hong

Alvin Loh

Brian K McNeil

Donna B Andrews

Joseph Leo Faulhaber

Stefan N Richards

Benjamin A Hutz

Hilary K Palman

Ahmed S Hussain

Paul J Leach

Scott Field

Michael Todd Kramer

Andrew John Fuller

Sean O Lyndersay

Richard Bruce Ward

Marc E Seinfeld

Matthew P Rhoten

Art Shelest

Issa Yousef Khoury

Zeke Book Odins-Lucas

Carl M Carter-Schwendler

Andrew Peter Sinclair

Allen Marshall

Vikram Madan

Charles Andrew Turner

Ramesh Chinta

William Mak

Catalin Daniel Sandu

Lior Arzi

Michael Jarrett

Gary Scot Henderson

Jason J Joyce

Jonathan Mark Keller

Christopher R Jones

Vishal Kapoor

Suresh Babu Velagapudi

Igal Figlin

Ajith Kumar

Krishna V Kotipalli

Andrew J Newman

Tse-Ching Yu

Jeremy D Croy

Cornelius K Van Dok

Jerry R Hughson, Jr

Ronald A Franczyk

Anastasia C Doerr

Piero Sierra

Eyal Zangi

Kanwaljit Marok

Cornelius K Van Dock

Kalid M Azad

Paul J Bryan

Michael G Q Sheldon

Ahmad S Hussain

Kumi N Hilwa

Eddy S Hsia

Nizan Manor

Stefan Richards

The subject disclosure relates to antimalware scanning, and more particularly to offline antimalware scanning of a host environment via an alternate, known safe operating system. An offline scanning product obtains data previously written by the host environment online antimalware scanning tool, e.g., configuration data and antimalware signatures in shared data stores accessible to the offline and online products, and uses that data to perform the offline antimalware scan. The offline scanning product writes results information and any quarantined files to other shared data stores, whereby the online environment, when rebooted, has access to the information, such as for review and to upload telemetry information to an online service for analysis. Also described is offline replacement of operating system files that cannot be cleaned or removed when online.

Offline scan, clean and telemetry using installed antimalware protection components

Methods, systems, and computer-readable media are disclosed for identifying telemetry data. A particular method scans a file and compares the file to at least one attribute to be used for telemetry collection. When the file is identified as a telemetry candidate, an offer to submit a sample of the file is sent to a server. A response to the offer is received from the server. If the response to the offer indicates an acceptance, a sample of the file is sent to the server.

Identification of telemetry data

Tracking malware state information assigned to computers in an enterprise network is described. A computer may transition from a current malware state to a new malware state in accordance with a plurality of stored rules and detection of an anti-malware event on the computer. Examples of anti-malware events include, but are not limited to, detection of new malware on the computer or cleaning of the computer. The malware state information for computers on the network may be mapped to a risk level representing an amount of risk that infected computers present to other computers on the network. The results of a risk level assessment for the computers on the network may be output via a user interface to enable an administrator of the network to prioritize servicing of computers with detected malware.

System and method for prioritizing computers based on anti-malware events

A system and method for protecting a computer system connected to a communication network from a potential vulnerability. The system and method protects a computer system that is about to undergo or has just undergone a change in state that may result in placing the computer system at risk to viruses, and the like, over a communication network. The system and method first detect an imminent or recent change in state. A security component and a fixing component react to the detection of the change in state. The security component may raise the security level to block incoming network information, other than information from a secure or known location, or information requested by the computer system. The fixing component implements a fixing routine, such as installing missing updates or patches, and on successfully completing the fixing routine, the security level is relaxed or lowered.

Dynamic protection of unpatched machines

An arrangement for dynamically identifying and intercepting potential software threats before they execute on a computer system is provided in which a file system filter driver (called a 'mini-filter') interfaces with an anti-malware service to selectively generate an alert event and allow the threat to run, in addition to generating an alert event and suspending the threat. The decision to suspend the threat or allow it to run is made through application of a cascading logic hierarchy that includes respective policy-defined actions, user-defined actions, and signature-defined actions. The mini-filter generates the alert event to the anti-malware service whenever a file is opened, or modified and closed. The service uses an engine to scan the file to identify potential threats which are handled though application of the logic hierarchy which provides for configurations defined in a lower tier of the hierarchy to be overridden by those contained in a higher tier.

Detection and dynamic alteration of execution of potential software threats

A system and method for controlling access to a computer provides for loose security within a local network while retaining strong security against external access to the network. In one embodiment, a user has access to trusted nodes in a secured group within an unmanaged network, without being required to choose, enter and remember a login password. To establish such a secure blank password or one-click logon account for the user on a computer, a strong random password is generated and stored, and the account is designated as a blank password account. If the device is part of a secured network group, the strong random password is replicated to the other trusted nodes. When a user with a blank password account wishes to log in to a computer, the stored strong random password is retrieved and the user is authenticated.

Method and system for controlling access privileges for trusted network nodes

In an implementation of user interface transition, a user interface logon page is displayed with selectable logon controls that each have a corresponding user-identifiable indicator. A transition from the user interface logon page to a user interface desktop page is initiated in response to a selectable logon control being selected. The transition displays the user-identifiable indicator corresponding to the selectable logon control uninterrupted throughout the transition, and the user-identifiable indicator corresponding to the selectable logon control is displayed on the user interface desktop page.

User interface transition

A system and method for generating aggregated content views in a computing network are provided. A host computing device obtains a request for an aggregated view of content corresponding to a set of criteria. The host computing device queries itself and each computing device in a defined network for locally stored content matching the set of criteria. The query results are merged and displayed to a user at the host computing device as an aggregated list view.

System and method for generating aggregated data views in a computer network

In an implementation of user interface start page, the start page includes a user-identifiable indicator associated with a user of a computing system to indicate that the user is logged-on to the computing system. The user interface start page also includes user-selectable controls from one or more regions of a user interface desktop page which is displayed after a transition from the user interface start page to the user interface desktop page. Each of the user-selectable controls on the user interface start page initiate a display of information associated with the user when selected.

User interface start page

This invention is directed to provide a method for enabling an administrator to monitor and selectively limit the computer functions available to a user. The method is carried out on a personal computer by an administrator, and administrator decisions can be enforced on other personal computers in a local network. The invention enables an administrator to restrict a user's logon hours, logon duration, access to computer functions, and access to applications based on content rating. In addition, the administrator may temporarily restrict or extend normally allowed access privileges. The invention also allows for the monitoring, auditing, and reporting of a user's computer function usage to an administrator.

User controls for a computer

Systems and/or methods are described that enable a credential interface. These systems and/or methods may build a credential user interface enabling a user to choose between multiple credentials and submit an authenticator for a chosen credential. These systems and/or methods may also gather information about arbitrary credentials and build a user interface for submission of authenticators for these arbitrary credentials.

Credential interface

Methods and apparatuses are provided for controlling application software while switching between session in a multi-session computing environment. An apparatus includes memory coupled to switching logic and application program managing logic. The switching logic is configured to selectively switch console control of a computing device between at least two user kernel sessions that are maintained in the memory. The application program managing logic is configured to selectively control at least one application program that is operatively configured within at least one of the user kernel sessions. For example, the application program managing logic can be configured to stop the operation, restart certain application programs, notify application programs about switching events, and/or adjust the playback of audio and/or video signals associated certain application programs.

Methods and apparatuses for handling single-user applications in multi-user computing environments

A user interface is configured to identify and display each of the one or more service providers servicing the user's computing system. The interface also identifies the presence information that is being supplied to the service providers by the user's computing system for publication. The presence information that is provided to the service providers can include, but is not limited to, the name, alias, location, and network status of the user. A user can make global or discrete customized changes to the presence information that is provided to each of the service providers through the user interface. Modifications made to the presence information can also be made automatically to reflect a new condition or status in the user's presence on a network that is provided by a service provider.

Controlling publication of presence information

Embodiments of a feedback-driven malware detector are directed to protecting a computer from programs that perform actions that are malicious or not expected by a user. In one embodiment, the feedback-driven malware detector performs a method that initially determines whether the state of an application program scheduled to be added to an extensibility point on a computer is already known. If the state of the object is not already known, the user is informed that an application program is being installed on the computer and that the application program is being added to an extensibility point. Then, input is obtained from the user that assists in determining whether the application program is malware.

Feedback-driven malware detector

Growing community of inventors

Bellevue, WA, United States of America

Sterling M Reasor