Symantec Corporation

Symantec Operating Corporation

Tim Naftel

Mark Kevin Kennedy

Michael Spertus

Terence W Noonan

Adam Glick

Spencer Dale Smith

Steven Michael Umbehocker

Thomas Lanzatella

Patrick Gardner

Kirk Clowser

Peter Linhardt

Shishir S Asgaonkar

Elliot J Murphy

Shailesh Waman Chaudhari

Richard Gough

Gary Philips

Upon detection of a rootkit, a host computer system is rebooted. The boot process is interrupted. Access to a media, e.g., a volume or disk, containing the rootkit is gained and the media is directly accessed. The rootkit is disabled, e.g., renamed or deleted, and the host computer system is rebooted a second time. If the rootkit has not been previously removed, e.g., only renamed, the rootkit is removed, e.g., using a conventional antivirus application. Thus, upon detection of a rootkit, the rootkit is removed without a clean boot.

Utilizing early exclusive volume access and direct volume manipulation to remove protected files

A system for distributed discovery and management of frozen images includes a first and a second computer host, a first and a second frozen image agent and a frozen image server. Each of the first and second frozen image agents may be configured to identify one or more storage hierarchies hosted at a respective computer host, and to provide an encoding representing the identified storage hierarchies to the frozen image server. The frozen image server may be configured to aggregate the encodings provided by the frozen image agents into a system-level storage hierarchy catalog.

System and method for distributed discovery and management of frozen images in a storage environment

Growing community of inventors

Longmont, CO, United States of America

Tim Naftel