Abstract: Antivirus software detects malware on a computer and the landing time of the malware is determined; a time window around the landing time is determined. Optionally requiring the landing time of the malware to be before the installation time of the antivirus software eliminates false positives. Any files of the computer systems that have a creation time within the time window are suspect. If the prevalence value and the maturity value of the suspect file are below respective thresholds then it is concluded that the file is malware and it is deleted. No virus signature or virus pattern that matches the deleted file need be relied upon or used. The detected malware may be the original mother file or a dropped file. An online prevalence and maturity database is used. The launching time of the malware may be used instead of the landing time.

Abstract: A method and system for detecting a mobile model are provided. The system gathers model IDs by receiving a customized massage from a sender and then storing the model ID, issuing a WAP PUSH message containing an access URL to a mobile station, receiving a request with a UserAgent attached and mobile phone number from a mobile station, adding a new record of the mobile phone number and its corresponding UserAgent into a ID database when the UserAgent is not in the mapping table.