Abstract: A system and method for reducing false positive indications of pestware on a protected computer is disclosed. In one variation, the method includes tracking activities of a user at the protected computer, monitoring events at the protected computer, identifying events that are potentially indicative of pestware, comparing at least one of the events with at least one of the activities of the user and initiating, in response to the comparing indicating the activities of the user are unconnected with the events, a user prompt that informs the user about the events to enable the user to make a decision relative to managing the events.

Abstract: Systems for preventing pestware activity are described. One embodiment a heuristic engine configured to identify repeat pestware activity and configured to block the repeat pestware activity; an operating system pestware shield in communication with the heuristic engine, the operating system pestware shield configured to detect pestware activity and report the pestware activity to the heuristic engine; and a browser pestware shield in communication with the heuristic engine, the browser pestware shield configured to detect pestware activity and report the pestware activity to the heuristic engine.

Abstract: A method and system for removing pestware from a computer is described. One illustrative embodiment detects that pestware is present on a computer, automatically suspends connectivity of the computer with a network, and removes the pestware from the computer while the connectivity of the computer with the network is suspended. This prevents the pestware from downloading additional pestware from the network in response to a removal attempt.

Abstract: Systems and methods for collecting files related to malware are described. In one embodiment, a system includes a malware detection module configured to analyze a set of files of a protected computer to determine that a first file of the set of files is related to potential malware. The system also includes a malware reporting module configured to selectively transfer the first file to a host computer.