Mcafee, Inc.

Vinoo Thomas

Nitin Jyoti

Rahul Mohandas

Palasamudram Ramagopal Prashanth

Babu Nath Giri

Prashanth P Ramagopal

Cedric Cochin

Rachit Mathur

Plasamudram Ramagopal Prashanth

A system, method, and computer program product are provided for identifying a file utilized to automatically launch content as unwanted. In one embodiment, a file is identified in response to a detection of unwanted code, the file utilized to automatically launch content. Additionally, it is determined whether an identifier associated with the unwanted code is included in the file. Further, the file is identified as unwanted based on the determination.

System, method, and computer program product for identifying a file used to automatically launch content as unwanted

Methods, apparatus, systems, and articles of manufacture for alerting the presence of bundled software during an installation are disclosed. An example method includes identifying installation of a software product. The software product is scanned to identify first information, the first information to include information extracted from a file associated with the software product that is indicative of a main application to be installed as part of the software product. Information displayed to a user during the installation of the software product is scanned to identify second information. Whether a bundled application is included in the software product is identified based on the first information, the second information, and the signature file.

Alerting the presence of bundled software during an installation

A technique allows a user client to receive a software product from a server. The user client may determine if the software product includes other potentially unwanted programs by reading one or more graphical user interface instances that are created during installation of the software product. The graphical user interface instances are read to identify information related to software identifiers of the software product and of potentially unwanted programs. A signature file may be received from a third-party server. The software identifiers of the software product and potentially unwanted programs can be checked against the signature file during installation of the software product in order to identify the presence of potentially unwanted programs that may be bundled with software product.

A system, method, and computer program product are provided for redirecting internet relay chat (IRC) traffic identified utilizing a port-independent algorithm and controlling IRC based malware. In use, IRC traffic communicated via a network is identified utilizing a port-independent algorithm. Furthermore, the IRC traffic is redirected to a honeypot.

System, method, and computer program product for redirecting IRC traffic identified utilizing a port-independent algorithm and controlling IRC based malware

A system, method, and computer program product are provided for directing predetermined network traffic to a honeypot. In use, predetermined network traffic originating from a node in a local area network and/or a virtual private network is identified. Further, the predetermined network traffic is directed to a honeypot.

System, method, and computer program product for directing predetermined network traffic to a honeypot

A system, method, and computer program product are provided for identifying unwanted activity utilizing a honeypot accessible via virtual local area network (VLAN) trunking. In use, a honeypot device is allowed to be accessed via VLAN trunking. Furthermore, unwanted data is identified, utilizing the honeypot device.

System, method, and computer program product for identifying unwanted activity utilizing a honeypot device accessible via VLAN trunking

Systems and method to detect malicious media file are described. In one example, an apparatus including a network connection, a memory, and a programmable processor communicatively coupled to the memory is discussed. The memory can include instructions, which when executed by the programmable processor cause the apparatus to receive a data stream from the network connection and detect at least a portion of a media file within the data stream. The instructions can also cause the apparatus to determine a file type of the media file and extract the media file from the data stream. Further, the instructions cause the apparatus to parse the media file to location a suspicious tag, extract an embedded URL from the suspicious tag, determine with the embedded URL is malicious, and block the media file if the embedded URL is malicious.

Growing community of inventors

Chennai, India

Vinoo Thomas