Abstract: Techniques for remediating an infected file are disclosed. In one embodiment, a method may have the steps of maintaining a plurality of file identities within a remediation repository each associated with a file, wherein for each file identity one or more regions of interest of the associated file are selectively identified, the one or more regions of interest for each file collectively representing less than all of the file; in response, selecting a file associated with a file identity from the remediation repository that matches the infected file; selectively comparing the one or more regions of interest of the matching file with one or more corresponding regions of the infected file; and based on comparing the regions, replacing at least one portion of the one or more regions of the infected file with at least one corresponding portion of the one or more regions of interest of the matching file.

Abstract: Various systems and methods distribute enforcement of browser rules. For example, one method can involve receiving, from a browser control client, information indicating that a user is accessing the Internet via a browser. The information received from the client can include a login name submitted by the user via the browser. The browser is installed on a computing device, and the browser control client is also installed on the computing device. The method can then send, to the browser control client, a set of one or more browser rules associated with the login name for enforcement on the computing device, in response to receipt of the information.

Abstract: A method and apparatus for monitoring a computer system for malicious software is provided. The method for monitoring malicious software proliferation includes processing a deceptive contact address associated with a monitoring device and inserting the deceptive contact address into a contact list, wherein malicious software self-propagates through the contact list, wherein the monitoring device receives a copy of the malicious software through the deceptive contact address.

Abstract: Systems and methods for computer virus detection are presented. In one embodiment; an computer virus detection method includes: receiving an indication of a change to a file; performing a virus analysis process, including executing the changes to the file in a virtual machine and examining results of the executing the changes; and handling the file based upon the virus analysis. The virus analysis can be performed in a system in which the change to the file occurs. Handling the file can include treating the file as potentially infected with a virus based upon the virus analysis. In one exemplary implementation, examining the results includes comparing the results of executing the changes to the file to other results from executing changes to another file, wherein the file is identified as potentially infected with a virus if the examining results indicates the results of executing the changes to the file are similar to results from executing changes to another file.

Abstract: A method and apparatus for using a dynamic policy to manage a file purging process is described. In one embodiment, a method for using the dynamic policy to purge files comprising processing a dynamic policy for purging files from a computer wherein the dynamic policy comprises one or more metrics and applying the dynamic policy to a plurality of files to identify at least one file to be purged.

Abstract: Systems and methods for computer virus detection are presented. In one embodiment; an computer virus detection method includes: receiving an indication of a change to a file; performing a virus analysis process, including executing the changes to the file in a virtual machine and examining results of the executing the changes; and handling the file based upon the virus analysis. The virus analysis can be performed in a system in which the change to the file occurs. Handling the file can include treating the file as potentially infected with a virus based upon the virus analysis. In one exemplary implementation, examining the results includes comparing the results of executing the changes to the file to other results from executing changes to another file, wherein the file is identified as potentially infected with a virus if the examining results indicates the results of executing the changes to the file are similar to results from executing changes to another file.