Abstract: Systems and methods are presented for performing sandboxing to detect malware. Sample files are received and activated individually in separate sandboxes in one mode of operation. In another mode of operation, sample files are assigned to pools. Sample files of a pool are activated together in the same sandbox. The sample files of the pool are deemed to be normal when no anomalous event is detected in the sandbox. Otherwise, when an anomalous event is detected in the sandbox, the sample files of the pool are activated separately in separate sandboxes to isolate and identify malware among the sample files.

Abstract: This invention relates generally to systems and methods for rapid, low-latency detection of viruses in network transmissions and specifically to methods for determining which parts of a network transmission might contain viruses and checking and cleaning only those parts of the transmission which could potentially be infected as soon as sufficient information is available for such a check.

Abstract: Detecting viruses that may be transferred between a distributed computer network, such as the Internet, and a host computer. A host computer performs its own virus scanning on data, using executables code downloaded to its browser upon a request for data from the Internet, such as an HTTP request. Code is downloaded to the host computer, and is configured to create a virus scan module on the host computer upon such a request. The module is used to detect viruses in data transferred between the host computer and the Internet. Virus scanning is performed thereafter on the host computer. In cases where certain browsers may not be capable of supporting local virus scanning, code is first downloaded to determine whether local scanning is possible. If so, the virus scan module is then downloaded and executed.