Abstract: A computer has a storage device that is infected with malicious software (malware). The malware uses stealth or rootkit techniques to hide itself in the storage device. A security module within the storage device detects the malware by comparing the files read from the storage device to those reported by the operating system. Upon detecting the malware, the security module prepares the computer for malware obfuscation by storing information describing the location of the malware, deploying an executable file, and configuring it to run on reboot. The executable file executes upon reboot and locates the data on the storage device associated with the malware. The executable file obfuscates the data so that the malware no longer loads at boot time, thereby disabling the rootkit technique. The computer reboots and the security module remediates the malware infection.

Abstract: A method includes decreasing a suspicion of a negative action by an application if the application has previously performed a positive action. The positive action is an action that is never or rarely taken by malicious code. In one example, the positive action is use of a user interface element by the application to have a user interaction with a user of the computer system. By taking into consideration the positive action by the application, the occurrence of false positives is minimized.

Abstract: A computer includes a file system that supports virtualization. A scanning module identifies a file to be scanned for malware and a virtualized file detection module determines whether the file is virtualized. A file retrieval module locates a virtualized version of the file if the file is determined to be virtualized, and a malware detection module determines whether the virtualized version of the file contains malware. If malware is found, the malware detection module takes remedial action to address any security threat posed by the malware.

Abstract: A computer has protected resources presenting threat vectors that malicious software can use to attack the computer. A security module has monitoring components that monitor the protected resources to detect malicious software. The security module detects if a protected resource enters a steady security state. In response to a protected resource entering a steady state, the security module selectively disables the components that monitor the protected resource, thereby conserving the computing resources utilized by the security module and freeing the computing resources for other tasks. If the resource exits the steady security state, the security module temporarily blocks access to the resource while it enables the monitoring components for that resource.

Abstract: Improved file tracking methods and file re-positioning or file defragmenting mechanisms are disclosed for use with a differential rate memory device which has allocatable storage units disposed in regions of comparatively faster data access and of comparatively slower data access for storing retrievable data file contents in such regions.