Abstract: A facility is described for preventing an application from becoming infected with malicious code. In various embodiments, the facility starts an application in debug mode, intercepts an application program interface method that loads code, receives an indication that the application program interface method was invoked to load a component, determines whether the component is a trusted component, and, when the component is not trusted, prevents the component from being loaded.

Abstract: A method and system for reflecting differences between two files. The method includes generating a base signature file having a plurality of base bit patterns, each base bit pattern being generated as a function of a portion of data in a first file. A second file containing a plurality of revised bit patterns is generated from a second file. Each revised bit pattern is compared to and matches at least one of the base bit patterns. A delta file reflecting the differences between a first file and the second file based on the base signature file, the delta signature file, and the second file is created.