Abstract: A system and a method are disclosed for creating a new partition. The technique includes initially allocating initially available sectors in a designated new partition area of a source partition to the new partition and subsequently allocating additional sectors in the designated new partition area of the source partition to the new partition that have subsequently become available.
Abstract: A method includes randomly mutating a virus definition file on a first host computer system to create a first mutated virus definition file, and randomly mutating the virus definition file on a second host computer system to create a second mutated virus definition file, the second mutated virus definition file being different than the first mutated virus definition file. Because of the differences between the first and second mutated virus definition files, a new unknown virus variant undetected on the first host computer system is detected and collected on the second host computer system thus preventing the unknown virus variant from becoming widespread.
Abstract: A system for protecting a block in a destination storage device including a data mover operable to move data from a source storage device to the block, and a controller coupled to the data mover, the controller operable to detect an application write request to the block and to stall the application write request while a data move operation initiated by the data mover is terminated.
Abstract: A method includes determining whether the exception handling frames on the stack are uncorrupt prior to execution of an exception handler dispatcher. Upon a determination that the exception handling frames on the stack are uncorrupt, the method further includes allowing the execution of the exception handler dispatcher to proceed. Conversely, upon a determination that the exception handling frames on the stack are corrupt, protective action is taken to prevent the malicious code on the host computer system from exploiting and/or damaging the host computer system.
Abstract: A prologue and an epilogue of a function are hooked. Completion of the prologue is stalled in a first state of a stack frame, and a copy of the first state of the stack frame is saved. Completion of the prologue is initiated, permitting execution of the function. Completion of the epilogue is stalled in a second state of the stack frame. The saved copy of the first state of the stack frame is located and compared with the second state of the stack frame. A determination is made whether the stack frame is corrupted based on the comparison. Upon a determination that the stack frame is corrupted, the second state of the stack frame is replaced with the copy of the first state of the stack frame, and completion of the epilogue is initiated, allowing the function to complete.
Abstract: A storage management device includes a plurality of I/O processing modules for accessing units of storage by specifying an address and a time. The I/O processing modules receive I/O requests, classify I/O requests, and extract I/O control information associated with the I/O requests. The extracted I/O control information is processed and at least one physical store is communicated with in response to the processed I/O control information.
Abstract: A technique is disclosed for protecting a file. In one embodiment, the technique comprises requesting access to a file, accessing a vnode associated with the file; and executing a substitute routine associated with the vnode.
Abstract: Computer-implemented methods, apparati, and computer-readable media for detecting malicious computer code in a file (2) associated with a computer (10). A method of the present invention comprises the steps of determining whether there is more than one hard link (1) to the file (2); and when there is more than one hard link (1), ascertaining the identities of all the hard links (1), and performing an antivirus scan on the file (2) based upon the hard link(s) (1) having the most restrictive scanning criteria of all the hard links (1), or upon the union of scanning criteria amongst all the hard links (1).
Abstract: Tools and techniques are provided for using a snapshot, not a full volume copy, to preserve deleted items when creating an image file with other items from a computer storage volume. One method classifies items as desired or not, enables snapshotting, then deletes undesired items, then creates a blockwise volume image in which the deleted items are not imaged, and finally disables snapshotting. Systems and configured storage media for imaging selected files and folders are also provided.
Abstract: Methods, systems, and computer program instructions for enabling users of pervasive devices to remotely access and manipulate information in ways that might otherwise be impossible or impractical because of inherent limitations of the device. The disclosed techniques enable a wide variety of data manipulation operations to be performed on behalf of the pervasive device, for a wide variety of content types. In preferred embodiments, no modifications or add-ons are required to the pervasive device.
Type:
Grant
Filed:
March 7, 2005
Date of Patent:
August 7, 2007
Assignee:
Symantec Corporation
Inventors:
Sandeep Kishan Singhal, Barry Eliot Levinson, Darren Michael Sanders
Abstract: Methods, apparati, and computer program products enforce computer network security policies by assigning network membership to a client (105) based on the client's compliance with the security policies. When a client (105) requests (305) a network address, the DHCP proxy (110) intercepts the request and assigns (350) that client (105) a logical address on the protected network (140) if the client (105) is in compliance with the security policies. If the client (105) is not in compliance with the security policies, in various embodiments, the DHCP proxy (110) assigns (350) the client (105) an address on a restricted network (145) or no network address at all.
Type:
Grant
Filed:
November 27, 2002
Date of Patent:
July 24, 2007
Assignee:
Symantec Corporation
Inventors:
William E Sobel, Greg Vogel, Bruce McCorkendale
Abstract: Methods, systems, and computer readable media utilize a stream manager (101) to efficiently scan stream (105) based data (103). A stream manager (101) receives (801) data (103) from a stream (105). The stream manager (101) makes (807) received data (103) serially available to a plurality of modify scanners (109) in a specific order, and makes (809) received data (103) available in parallel to a plurality of read-only scanners (111). The stream manager (101), responsive to data (103) having been released by each modify scanner (109) of the plurality and by each read-only scanner (111) of the plurality, transmits (515) released data (103) to a destination (113).
Abstract: In a multiprocessor system that includes a plurality of processor modules, each one of which includes its own internal clock, one of the plurality of processor modules is designated as a master processor module having a master internal clock. Each other processor module is designated as a slave processor module having a slave processor module internal clock. Each slave processor module synchronizes its internal clock with the master internal clock.
Abstract: A web page development application provides simultaneous display of a browser view and the corresponding descriptor language source view. The application provides graphical editing of the browser view. The corresponding descriptor language source view is automatically generated so as to be consistent with the browser view upon prompting by the user. The web page development application allows separate editing of the browser view and corresponding descriptor language source view and cross-synchronization such that changes to one view will automatically update the other view when prompted by the user.
Abstract: A method includes hooking a critical operating system function, originating a call to the critical operating system function with a call module of a parent application, stalling the call, determining a location of the call module in memory, and determining whether the location is in an executable area of the memory. Upon a determination that the call module is not in the executable area, the method further includes terminating the call. By terminating the call, execution of a child application that would otherwise allow unauthorized remote access is prevented.
Abstract: A system and a method for delivering location sensitive services within a short-range wireless environment. Service proxies are employed to customize queried information and make services available according to user identity and location.
Type:
Grant
Filed:
May 3, 2001
Date of Patent:
May 29, 2007
Assignee:
Symantec Corporation
Inventors:
Sandeep K. Singhal, Richard K. Neves, Darren M. Sanders
Abstract: A kernel mode memory scanning driver for use in safely scanning loaded drivers in the memory of computer systems utilizing Windows® NT based operating systems, such as Windows® 2000, Windows® XP, and other operating systems utilizing the Windows® NT kernel base, for viruses. Prior to scanning the loaded drivers for viruses, the kernel mode memory scanning driver hooks a driver unload function of the operating system, and stalls any calls to the driver unload function to prevent the loaded drivers from being unloaded during scanning. After scanning is complete, any stalled calls to the driver unload function are released. In one embodiment, the kernel mode memory scanning driver is implemented as a Windows® NT 4.0 kernel mode memory scanning driver, and thus can be used on computer systems utilizing Windows® 2000 or Windows® NT without platform specific code.
Abstract: Methods, apparati, and computer program products for detecting and responding to fast-spreading network worm attacks include a network monitoring module, which observes failed network connection attempts from multiple sources. A logging module logs the failed connection attempts. An analysis module uses the logged data on the failed connection attempts to determine whether a sources is infected with a worm using a set of threshold criteria. The threshold criteria indicate whether a source's failed connection attempts are non-normal. In one embodiment, a response module responds to the computer worm by, e.g., alerting a user or system administrator, terminating an infected process, or terminating the infected source's network access.
Type:
Application
Filed:
December 15, 2006
Publication date:
April 12, 2007
Applicant:
SYMANTEC CORPORATION
Inventors:
Mark Spiegel, Bruce McCorkendale, William Sobel
Abstract: One or more specified system calls of a running process are trapped in kernel space from user space. While the process is stopped, information associated with the process is read and a security analysis is performed on the information to determine whether malicious code activity is detected, such as a buffer overflow. If malicious code activity is detected, protective action is taken, such as killing the specified system call. Otherwise, if malicious code activity is not detected, the specified system call is restarted.
Abstract: A method of dynamically hooking runtime processes without interrupting the flow of execution includes: suspending a thread; hooking a function comprising modifying code of the function; and determining whether the thread was executing the modified code when the thread was suspended. If the thread was not executing the modified code, the thread is resumed. If the thread was executing the modified code, the context of the thread is changed to redirect the thread to a saved copy of the original prologue. In this manner, unpredictable behavior of the thread is avoided.