Abstract: A method is provided in one example embodiment that includes rebasing a module in a virtual partition to load at a fixed address and storing a hash of a page of memory associated with the fixed address. An external handler may receive a notification associated with an event affecting the page. An internal agent within the virtual partition can execute a task and return results based on the task to the external handler, and a policy action may be taken based on the results returned by the internal agent. In some embodiments, a code portion and a data portion of the page can be identified and only a hash of the code portion is stored.

Abstract: A system, method and computer program product are provided for performing a security or maintenance operation in association with virtual disk data accessed independent of a virtual machine. In use, data stored on a virtual disk is accessed at least in part independent of a virtual machine. Further, a security or maintenance operation is performed in association with the accessed data.

Abstract: A method is provided in one example embodiment that includes receiving in an external handler an event notification associated with an event in a virtual partition. A thread in the process in the virtual partition that caused the event can be parked. Other threads and processes may be allowed to resume while a security handler evaluates the event for potential threats. A helper agent within the virtual partition may be instructed to execute a task, such as collecting and assembling event context within the virtual partition, and results based on the task can be returned to the external handler. A policy action can be taken based on the results returned by the helper agent, which may include, for example, instructing the helper agent to terminate the process that caused the event.

Abstract: A system, method and computer program product are provided for scanning files. A plurality of file names in a registry of a computer is identified. By this identification, files associated with the file names are scanned. Another system, method and computer program product are further provided. In particular, a change in a registry of a computer is first identified. Then, a scan is conditionally performed based on whether the change in the registry is identified.

Abstract: A system, method and computer program product are provided for preventing malware infection. In use, mass-mailing-type malware is prevented from sending electronic messages via a network. Malware is also prevented from communicating. Still yet, unrecognized attachments are prevented from opening, and executable files are prevented from being infected via the network.

Abstract: A system, method and computer program product are provided for scanning for spyware utilizing a virus scanner. In use, at least one computer is scanned for viruses utilizing a virus scanner. Still yet, the computer is further scanned for spyware utilizing the virus scanner. Such computer is scanned for the spyware by scanning a registry associated therewith.

Abstract: A security system, method and computer program product are provided. In use, a request from a remote computer to write to a file on a local computer is identified. It is then determined whether the request results in the local computer being infected with malware. If it is determined that the request results in the local computer being infected with malware, communications between the remote computer and the local computer are blocked.

Abstract: A system, method and computer program product are provided for scanning for spyware utilizing a virus scanner. In use, at least one computer is scanned for viruses utilizing a virus scanner. Still yet, the computer is further scanned for spyware utilizing the virus scanner. Such computer is scanned for the spyware by scanning a registry associated therewith.

Abstract: A security system, method and computer program product are provided. In use, a request is received to open a file on a local computer. Thereafter, it is determined whether the request is received from a local process operating on a local computer or from a remote computer, so that such determination may be used for security purposes.

Abstract: A system, method and computer program product are provided for on-access computer virus scanning of files in an efficient manner. If no identifier is assigned to a process for accessing files, virus detection actions are selected based at least in part on the identification of the process. Further, an identifier is assigned to the process. Thereafter, virus detection actions may be selected based at least in part on the identifier for accelerating the selection process. In operation, the selected virus detection actions are performed on the files.