Abstract: Detecting deviations from normal behavior in a processing system is disclosed. Independently for each of a plurality of processes associated with the processing system, a learning phase is started for the process based on a start criteria associated with the process, the normal behavior associated with the process is learned during the learning phase, the learning phase for the process is stopped based on a stop criteria associated with the process, and a protect phase is started for the process.

Abstract: When the user works at home on his home computer, a work monitor logs his file activities on all the drives of his home computer in a work monitor log, which can be displayed in a work monitor window. The user can choose to update from the work monitor window. When update is selected, the files in the work monitor log are selected for file synchronization. When file synchronization is performed, files on the user's home computer are synchronized with corresponding files on the user's office computer. Preferably, the date and time of a file on the home computer selected for file synchronization are compared to the corresponding date and time of the corresponding file on the office computer to determine the direction of file synchronization. The newer version of the file overwrites the older version of the file on either the home or office computer.

Abstract: A method and article of manufacture, such as a magnetic disk containing computer instructions, for preventing a device driver from disabling an operating system during boot-up is provided. Fault tolerant booting software is provided in a computer having remote control software. The computer is able to provide video information to another remote computer in response to a user's input. The fault tolerant booting software interfaces with the computer's various device drivers, including, a video driver, keyboard driver, and a pointing device driver. The fault tolerant booting software attaches to identified device drivers to prevent a faulty driver filter from rendering the operating system inoperable for failing to load during a bootstrap routine. The method includes a step of restoring registry information after the fault tolerant booting software attaches the device filters to identified device drivers. Messages are also displayed to identify a faulty device driver.