Abstract: A system, method, and computer program product are provided for performing an analysis on a plurality of portions of potentially unwanted data each requested from a different device. In use, a detection of potentially unwanted data (e.g., potentially malicious data) is identified based on a first analysis. Additionally, receipt of a plurality of portions of the potentially unwanted data is requested, where each of the plurality of portions is requested from a different device. Further, a second analysis is performed on the plurality of portions of the potentially unwanted data for determining whether the potentially unwanted data is unwanted (e.g., malicious).

Abstract: A system, method, and computer program product are provided for automatically identifying potentially unwanted data as unwanted. In use, data determined to be potentially unwanted (e.g. potentially malicious) is received. Additionally, the data is automatically identified as unwanted (e.g. malicious). Furthermore, the data is stored for use in detecting unwanted data (e.g. malicious data).

Abstract: A macro virus definitions database is maintained and includes a set of indices and associated macro virus definition data files. One or more of the macro virus definition data files are referenced by the associated index. Each macro virus definition data file defines macro virus attributes for known macro viruses. The sets of the indices and the macro virus definition data files are organized according to macro virus families. One or more strings stored in a suspect file are compared to the macro virus attributes defined in the one or more macro virus definition data files for each macro virus family in the macro virus definitions database. The macro virus family to which the suspect file belongs is determined from the indices for each of the macro virus definition data files at least partially containing the suspect file.

Abstract: A system, method and computer program product are provided for protecting a computer in an opened share mode. Initially, a computer is run on a network in an opened share mode. In operation, attempts to access the computer by applications are monitored. Further, it is determined whether the applications attempt to modify the computer. A security event is then executed in response to any attempt to modify the computer.

Abstract: A system and a method for performing partitioned scanning of a dataset for malware in a distributed computing environment is disclosed. A dataset is maintained in a plurality of structured databases in the distributed computing environment. Each database stores a plurality of data item groups which each include a plurality of individual data items. Each such data item is uniquely identified within the dataset by a data item identifier. A set of indices is stored in a centralized database. The set of indices includes a list of scanned data item identifiers for each data item within the dataset scanned for malware and a list of last entry numbers for each data item group stored in each database. Each last entry number corresponds to one such data item within the data item group last scanned for malware. A plurality of malware scanners are executed in substantial concurrency.

Abstract: A system and method for executing computer virus definitions containing general purpose programming language extensions is described. One or more virus definition records are stored in a computer virus data file. Each virus definition record includes an identifier, a virus detection section and an extension sentence. The identifier uniquely identifies a computer virus. The virus detection section includes object code providing operations to detect the identified computer virus within a computer system. The extension sentence includes object code providing reusable operations implemented in a general purpose computing language. For each virus definition record, at least one of the object code of the virus detection section and the extension sentence is interpreted.

Abstract: A system and method for executing computer virus definitions containing general purpose programming language extensions is described. One or more virus definition records are stored in a computer virus data file. Each virus definition record includes an identifier, a virus detection section and an extension sentence. The identifier uniquely identifies a computer virus. The virus detection section includes object code providing operations to detect the identified computer virus within a computer system. The extension sentence includes object code providing reusable operations implemented in a general purpose computing language. For each virus definition record, at least one of the object code of the virus detection section and the extension sentence is interpreted.

Abstract: A system, method, and computer program product are provided for automatically identifying potentially unwanted data as unwanted. In use, data determined to be potentially unwanted (e.g. potentially malicious) is received. Additionally, the data is automatically identified as unwanted (e.g. malicious). Furthermore, the data is stored for use in detecting unwanted data (e.g. malicious data).