Abstract: A security module interfaces with a set of infection repair modules. Each repair module can perform a specific repair of an infection. Some of the repair modules utilize context information about the computer, such as the availability of a non-infected backup file. Further, the repairs performed by some repair modules are fine-grained while repairs of other repair modules are coarse-grained. The security module identifies malicious software infecting a computer and generates an infection object for each infection. The security module selectively routes the infection objects to the repair modules. In response, the repair modules provide repair objects representing repairs that the repair modules can perform on the infection. The repair objects have scores describing their thoroughness and complexity. The security module ranks the repair objects based on their scores and selects certain repairs for repairing the malicious software infections.

Abstract: An antivirus client module (114) includes a virus definitions module (312) holding information describing characteristics of files that can potentially be infected by viruses and information enabling a determination of whether a file is actually infected by a virus. The client module (114) also includes a filtering module (314) having a file information cache (410) describing characteristics of files. A file scanning module (316) can scan files to determine whether the files are infected by viruses. The antivirus client module (114) queries the file information cache (410) using the information describing characteristics of files to identify the set of files that are susceptible to a given virus. The file scanning module (316) scans the files in the set.

Abstract: A security server distributes security polices to the client computers. Each security policy includes an identifier identifying the process to which the policy pertains, and security rules for use with that process. The identifier includes a version hash and a code hash. The version hash of a process is likely to remain unchanged if the process is modified by a legitimate agent, such as by a software update. The code hash of a process is likely to change if the process is modified by a malicious agent. When a process executing on the client computer requests access to a resource, the client computer generates a version hash of the process and uses it to identify the security policy pertaining to the process. If the version hash matches a version hash in a security policy, but the code hash does not match, the client computer declares the process potentially malicious.