Abstract: Computer data containing compressed video data is examined to see if it is banned computer data, for example containing pirate or copyright-infringing video material, by examining the identifier of the video codec associated with the compressed video data. Certain video codec identifiers are highly correlated with the computer data concerned being banned computer data. Thus, an examination of the header file of the computer data may be used as an efficient and sensitive tool for identifying the computer data as banned computer data.

Abstract: An e-mail client serves to detect mass mailing malware by detecting if over a threshold number of addressees from within the address book of that e-mail client are being sent an e-mail or over a predetermined number of substantially identical e-mails are being sent by that e-mail client. A quarantine queue may be provided in which e-mail messages are held for a predetermined period prior to being sent out in order that separate e-mail messages being sent to a large proportion of the address book addressees may be identified and linked together.

Abstract: A malware scanner for DIME messages reads the file type associated with each data record within the DIME message to determine whether or not the payload data of that data record requires scanning. The length data within the header of each data record is used to move between data records within a DIME message as required during the malware scanning process.

Abstract: A malware scanner 2 operates as a low priority task within a multi-tasking environment. A pending scan database 14 is maintained storing details of computer files that have been written to a data storage device 6, but have not yet been scanned. The scanner 2 operates to subsequently scan these computer files for malware at which point they are removed from the pending scan database 14 and added to the scanned file database 16.

Abstract: A malware scanner (8) operates to scan compressed computer files (16) by compressing the malware signatures (17) using the same compression algorithm as used for the compressed computer file and then comparing the compressed malware signatures (18) with the compressed computer file directly.

Abstract: The malware definition data of mobile data processing devices is updated via a data channel associated with a wireless telephony link to that mobile data processing device. The data channel may be the same channel wed for SMS messaging and the transfer of control information. The mobile data processing device is typically a mobile telephone. The update data may be digitally signed to increase security.

Abstract: A system, method and computer program product are provided for accelerated scanning. Initially, a file access pattern associated with data is identified. The data is subsequently read based on the file access pattern. A virus scan is then performed on the data.

Abstract: A system, method and computer program product are provided for recognizing virus signatures. Initially, a list of virus signatures is provided. Next, the list of virus signatures is combined into a tree of virus signatures. Data is subsequently compared against the tree of virus signatures for virus signature recognition.

Abstract: Computer data containing compressed video data is examined to see if it is banned computer data, for example containing pirate or copyright-infringing video material, by examining the identifier of the video codec associated with the compressed video data. Certain video codec identifiers are highly correlated with the computer data concerned being banned computer data. Thus, an examination of the header file of the computer data may be used as an efficient and sensitive tool for identifying the computer data as banned computer data.

Abstract: An application program (6) may issue a file access request to an operating system (4) accompanied by a caching hint. This caching hint may be selected in dependence upon the file type and file size of the computer file to which access has been requested. The data defining which hint type is to be used for each combination of file type and file size may be adaptively updated depending upon measured performance for the different hint types. The hint defining data may be initialised in dependence upon the operating system version and the installed memory size of the computer system concerned.

Abstract: A malware scanner 2 operates as a low priority task within a multi-tasking environment. A pending scan database 14 is maintained storing details of computer files that have been written to a data storage device 6, but have not yet been scanned. The scanner 2 operates to subsequently scan these computer files for malware at which point they are removed from the pending scan database 14 and added to the scanned file database 16.

Abstract: The malware definition data 34 of a mobile data processing device 2, 6 is updated via a data channel associated with a wireless telephony link to that mobile data processing device. The data channel may be the same channel used for SMS messaging and the transfer of control information. The mobile data processing device is typically a mobile telephone. The update data may be digitally signed to increase security.

Abstract: An e-mail client serves to detect mass mailing malware by detecting if over a threshold number of addressees from within the address book of that e-mail client are being sent an e-mail or over a predetermined number of substantially identical e-mails are being sent by that e-mail client. The sending of e-mail messages to a substantial proportion of the addressees within an address book is a characteristic indicative of mass mailing malware. A quarantine queue may be provided in which e-mail messages are held for a predetermined period prior to being sent out in order that separate e-mail messages being sent to a large proportion of the address book addressees may be identified and linked together.

Abstract: An application program (6) may issue a file access request to an operating system (4) accompanied by a caching hint. This caching hint may be selected in dependence upon the file type and file size of the computer file to which access has been requested. The data defining which hint type is to be used for each combination of file type and file size may be adaptively updated depending upon measured performance for the different hint types. The hint defining data may be initialised in dependence upon the operating system version and the installed memory size of the computer system concerned.