Abstract: An anti-exploitation application identifies and prevents a malicious action from occurring on a client. To do so, a monitoring system instantiated on the kernel of the operating system of the client. The monitoring system stores information describing actions taken by the processor. When the monitoring system detects a triggering action, it sends the triggering action to the anti-exploitation application to determine whether the triggering action is an exploitation action. The anti-exploitation application accesses an evidence set for the triggering action and its related actions. The anti-exploitation application generates an execution hierarchy defining the hierarchical relationships between the triggering action and its related actions and tests the hierarchy against a ruleset of grammatically structured rules. If a grammatically structured rule in the ruleset indicates that the triggering action is an exploitation action, the anti-exploitation application takes a prevention action.

Abstract: A protection application detects and removes unwanted applications. The protection application scans a client device for suspected unwanted applications. A security server provides an application rating for detected applications to the client device. The application rating is generated based on application retention data received from client devices indicating whether users of the clients choose to remove or retain the application when given the option. The application retention data may be weighed based on a categorization of the clients providing the application retention data into to clients expected to have different reliability levels. The security server can also provide a definition specifying all known components associated with a suspected unwanted application. Responsive to a selection to remove a suspected unwanted application, the protection application uninstalls all components of the application.

Abstract: A protection application detects and removes unwanted applications. The protection application scans a client device for suspected unwanted applications. A security server provides an application rating for detected applications to the client device. The application rating is generated based on application retention data received from client devices indicating whether users of the clients choose to remove or retain the application when given the option. The application retention data may be weighed based on a categorization of the clients providing the application retention data into to clients expected to have different reliability levels. The security server can also provide a definition specifying all known components associated with a suspected unwanted application. Responsive to a selection to remove a suspected unwanted application, the protection application uninstalls all components of the application.

Abstract: A protection application detects and removes unwanted applications. The protection application scans a client device for suspected unwanted applications. A security server provides an application rating for detected applications to the client device. The application rating is generated based on application retention data received from client devices indicating whether users of the clients choose to remove or retain the application when given the option. The application retention data may be weighed based on a categorization of the clients providing the application retention data into to clients expected to have different reliability levels. The security server can also provide a definition specifying all known components associated with a suspected unwanted application. Responsive to a selection to remove a suspected unwanted application, the protection application uninstalls all components of the application.