Symantec Corporation

Wilson Meng

David Kane

Sonia Subramanian

Sourabh Satish

Shane Pereira

Nivedhitha Raman

Robert Spath

Yoshihiro Yasuda

The disclosed computer-implemented method for restarting computing devices into security-application-configured safe modes may include (1) configuring a security application to recognize a predetermined signal received via a predetermined hardware device that indicates that a user wants to restart the computing device into a security-application-configured safe mode that prevents suspicious applications from loading, (2) detecting the predetermined signal via an instance of the predetermined hardware device that is connected to the computing device, (3) setting, in response to detecting the predetermined signal, a registry key on the computing device that will instruct the computing device to boot into the security-application-configured safe mode during a restart sequence, and (4) restarting the computing device in the security-application-configured safe mode in response to detecting the registry key during the restart sequence. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for restarting computing devices into security-application-configured safe modes

Injected threads are tracked to detect malware that injects malicious code into the address space of a legitimate process. Relationships between threads of processes executing on a client and files stored by the client are mapped to identify files that create threads in executing processes. The address space of a process is analyzed to identify legitimate memory regions in the address space. A suspicious thread referencing a suspicious memory region of the address space outside of the legitimate memory regions is identified. The suspicious memory region is scanned to identify malware. The mapped relationships are used to identify the file that created the thread that referenced the address space in which the malware was identified. The malware in the file is remediated.

Tracking injected threads to remediate malware

The instant disclosure describes various exemplary systems and methods for exonerating an untrusted software component based solely on a trusted software component's non-optional or 'hard' dependency on the untrusted software component. In one example, a method for exonerating untrusted software components in this manner may include: 1) identifying a dependent software component, 2) determining that the dependent software component is a non-optional dependent component of at least one trusted software component, and then 3) classifying the dependent software component as a trusted software component. As detailed herein, such a method may enable security software to quickly and efficiently exonerate untrusted components by association without having to scan or perform other intrusive and/or resource-intensive security operations on such untrusted software components.

Systems and methods for exonerating untrusted software components

A computer-implemented method for repairing system files may include 1) identifying a request to repair a corrupted system file in an operating system, 2) receiving file metadata describing the corrupted system file and system metadata describing the operating system, 3) identifying an uncorrupted version of the corrupted system file by i) identifying a series of matching tests for matching the corrupted system file with the uncorrupted version, the series of matching tests including at least one file metadata item from the file metadata and at least one system metadata item from the system metadata, and ii) applying the series of matching tests in a predetermined order to a database of uncorrupted system files until a matching test matches the corrupted system file with the uncorrupted version of the system file. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

San Gabriel, CA, United States of America

Wilson Meng