Abstract: A method for improving security of peripheral devices is described. The method includes displaying, by a processor of a computing device, a code, receiving, by the processor, a user input after displaying the code, comparing, by the processor, the user input to the displayed code, and establishing, by the processor, secure communication between a peripheral device and a software application at the computing device based at least in part on a result of the comparing the user input to the displayed code.

Abstract: A computer-implemented method for managing file backup may include (i) detecting, by a computing device, an attempt to upload a file to a backup storage, (ii) calculating a degree of difference between the file and a previous version of the file on the backup storage, (iii) comparing, by the computing device, a list of applications that have written to the file with a list of acceptable applications for the file, (iv) calculating, based on the degree of difference and the comparison of the list of applications, a change score for the file, and (v) applying, based on the change score, a backup policy to the attempt to upload the file. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Mitigating malicious actions associated with graphical user interface elements may be performed by a computing device. A user interface element is monitored in a graphical user interface environment executing on the computing device. An association between the user interface element and a malicious action is determined. Access to the user interface element is blocked to prevent the malicious action.

Abstract: A method for improving security of peripheral devices is described. In one embodiment, the method includes sending, by a processor of a peripheral device, at least one packet of data to an operating system of a computing device, identifying, by the processor, execution of a software application on the computing device, performing, by the processor, a handshake protocol between the secure input device and the software application based at least in part on the execution of the software application, and establishing, by the processor, a secure session over a secure channel between the secure input device and the software application based at least in part on the handshake protocol. In some cases, the at least one packet of data identifies the peripheral device to the operating system as two or more peripheral devices such as a default input device and a secure input device.

Abstract: The disclosed computer-implemented method for automatically making selections in user interfaces may include (1) detecting, on a computing device, a user interface that comprises a prompt for a user of the computing device to select between a first option and a second option, (2) identifying a profile for making, on behalf of the user, a predetermined selection of one of the first option and the second option, (3) determining that the predetermined selection indicates that the first option should be selected on behalf of the user, and (4) selecting, from the prompt, the first option on behalf of the user. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Mitigating malicious actions associated with graphical user interface elements may be performed by a computing device. A user interface element is monitored in a graphical user interface environment executing on the computing device. An association between the user interface element and a malicious action is determined. Access to the user interface element is blocked to prevent the malicious action.

Abstract: Techniques for conserving battery power in devices are provided. One or more deferrable tasks are queued for later execution. An initiation of a subsequent charging event for a battery of the device is detected. The queued deferrable task(s) are enabled to be executed during the charging event. For instance, the queued deferrable task(s) may be enabled to be executed if the charging event is predicted to be a long duration charging event, such as by referring to a charging profile of the mobile device. In this manner, battery power is conserved while the device is in use and not connected to a battery charger.

Abstract: The subject disclosure is directed towards protecting against malware, by classifying a user's risk level, which corresponds to a likelihood of malware being activated. To make the classification, data is collected that represents a probability of encountering malware, a probability of a user activating that malware, and the impact to the machine is activated. The classification maps to a protection level, which may be dynamically adjustable, e.g., based upon current risk conditions. The protection level determines a way to mitigate possible damage, such as by running a program as a virtualized program, running a virtualized operating system, or sandboxing a process.

Abstract: Described is a technology by which a malware-compromised machine, such as a personal computer is cleaned through the use of a functional adjunct machine, such as a mobile device (or vice-versa). The functional adjunct machine performs actions on behalf of the malware-compromised machine and/or to assist the remediation. This may include downloading antimalware-related data (e.g., an application, antimalware code, signature updates and/or the like) via a marketplace/application store, and transferring at least some of the data and/or programs to the compromised machine. Other actions may include using the functional adjunct machine to boot the malware-compromised machine into a non-compromised state and providing the data or programs to allow remediation of the malware while in this state.

Abstract: Techniques for conserving battery power in devices are provided. One or more deferrable tasks are queued for later execution. An initiation of a subsequent charging event for a battery of the device is detected. The queued deferrable task(s) are enabled to be executed during the charging event. For instance, the queued deferrable task(s) may be enabled to be executed if the charging event is predicted to be a long duration charging event, such as by referring to a charging profile of the mobile device. In this manner, battery power is conserved while the device is in use and not connected to a battery charger.

Abstract: Aspects of the subject matter described herein relate to identifying good files and malware based on whitelists and blacklists. In aspects, a node starts a scan of files on a data store. In conjunction with starting the scan, the node creates a data structure that indicates the directories on the data store. The node sends the data structure to a whitelist server and a blacklist server and an indication of a last successful time of communication. The whitelist and blacklist servers respond to the node with information about any new files that have been added to the directories since the last successful communication. The node may subsequently use the information to identify known good files and malware.

Abstract: The subject disclosure is directed towards protecting against malware, by classifying a user's risk level, which corresponds to a likelihood of malware being activated. To make the classification, data is collected that represents a probability of encountering malware, a probability of a user activating that malware, and the impact to the machine is activated. The classification maps to a protection level, which may be dynamically adjustable, e.g., based upon current risk conditions. The protection level determines a way to mitigate possible damage, such as by running a program as a virtualized program, running a virtualized operating system, or sandboxing a process.

Abstract: Various principles for maintaining a shared repository of authorization scanning results, which may be populated with results of authorization scans of particular files (and other content units) as well as a signature for those particular files. When a particular file is to be scanned by a client computing device to determine whether it contains unauthorized software, a signature for the file may be calculated and provided to the shared repository. If the repository has a result for that file—as indicated by a signature for the file being present in the repository—the result in the repository may be provided to the client computing device that issued the query, and the client computing device may accept the answer in the shared repository. If the result is not in the repository (i.e., the file has not been scanned), then the file may be scanned, and a result may be placed in the repository.

Abstract: Aspects of the subject matter described herein relate to identifying good files and malware based on whitelists and blacklists. In aspects, a node starts a scan of files on a data store. In conjunction with starting the scan, the node creates a data structure that indicates the directories on the data store. The node sends the data structure to a whitelist server and a blacklist server and an indication of a last successful time of communication. The whitelist and blacklist servers respond to the node with information about any new files that have been added to the directories since the last successful communication. The node may subsequently use the information to identify known good files and malware.

Abstract: A system, method and computer program product are provided for protecting a computer in an opened share mode. Initially, a computer is run on a network in an opened share mode. In operation, attempts to access the computer by applications are monitored. Further, it is determined whether the applications attempt to modify the computer. A security event is then executed in response to any attempt to modify the computer.

Abstract: A system and a method for performing partitioned scanning of a dataset for malware in a distributed computing environment is disclosed. A dataset is maintained in a plurality of structured databases in the distributed computing environment. Each database stores a plurality of data item groups which each include a plurality of individual data items. Each such data item is uniquely identified within the dataset by a data item identifier. A set of indices is stored in a centralized database. The set of indices includes a list of scanned data item identifiers for each data item within the dataset scanned for malware and a list of last entry numbers for each data item group stored in each database. Each last entry number corresponds to one such data item within the data item group last scanned for malware. A plurality of malware scanners are executed in substantial concurrency.

Abstract: A method is provided for detecting computer viruses that infect text-based files. In accordance with a preferred embodiment, a collection of virus signatures reflecting sequences of characters or instructions known to be found in such viruses is maintained on a computer system. A virus detection program is also maintained for the purpose of comparing the contents of computer files to the virus signatures. Upon execution of the virus detection program, whitespace within text-based files is transformed such that each sequence of whitespace characters is replaced by a single whitespace character. Virus signatures of viruses known to infect text files are similarly transformed. A transformed text-based file is then searched for at least one of said virus signatures. The user is alerted to a possible virus infection if any of the virus signatures are found in a file.