Abstract: A system for computer security includes a signature of a signed library embedded in a program along with a set of transformations that were made during compiling and linking of the program. Computer security software periodically runs and opens the program (all programs) and when the program includes transformations, the computer security software rolls back the transformations to create a copy of the program then the computer security software calculates a check value on the copy and if the check value matches the signature, the program is allowed, otherwise the libraries/program has been compromised and the program is blocked and quarantined.

Abstract: During development, a whitelist is automatically created that includes entries for all programs that will run on the target device. Security software is included in the installation package. After the installation package is installed, the operating system runs the system security software and the system security software intercepts attempts to run any program and only allows programs to run that match an entry in the whitelist. In some embodiments, an entitlement file is created (manually, automatically, or a combination of both) and is included in the installation package. In such embodiments, after initialization, the system security software intercepts attempts to access resources of the target device by programs and only allows access to resources that are identified in the entitlement file for that program.

Abstract: A system and method for computer security of a protected device that has a processor and an operating system software running on the processor includes security software that runs on the protected device and has local data for control of the security software. Upon initialization of the security software, the security software loads the local data and periodically reads file-type associations from the operating system software. For each file-type association, the security software determines if that file type is permitted by the local data and if that file type is not permitted by the local data, the security software removes that file-type association from the operating system software.

Abstract: A system for intelligent managing whitelists and blacklist provides options and/or suggestions to the administrators and/or information technology team to allow administration of whitelists and/or blacklists based upon history and rules. For example, if permission to run a certain program is requested by several people in a group or organization and the program is not believed to have a virus, then, the administrator if presented with an option to enable (e.g., add to the whitelist) that program for the entire group or organization.

Abstract: A system and method of synchronizing a whitelist with an installation on a protected device includes detecting an installation and determining which programs are affected by the installation by parsing an installation file. Programs that are being installed by the installation are added to the whitelist; Programs that are being deleted by the installation are removed from the whitelist; and programs that are being modified by the installation are updated in the whitelist. Therefore, after the installation is complete, the whitelist contains entries that will allow execution of programs (executables, scripts, macros, etc.) that were installed by the installation.

Abstract: A computer security system with enhanced blacklisting includes administrative interfaces that accept user inputs to create and modify entries in a blacklist and a whitelist that define which programs are allowed to execute on one or more target computer systems. Upon an attempt to run a program, if the program is in the blacklist and not in the white list, the program is prevented from running. If the program is prevented from running, at a later time, an administrative interface is used to either block future execution of the program or to create an entry in the whitelist that allows future execution of a class of programs or only that the program until revoked. The whitelists and blacklists are for a single target computer or many computers.

Abstract: A system and method for computer security of a protected device includes monitoring software running on a protected device that periodically scans the protected device looking for changes to startup items that are suspicious. Upon finding such items, the monitoring software removes the suspicious item and/or sends details of the item to a server. At the server, a researcher reviews the details to determine if the changes are malicious and what steps must be taken to back-out the malicious changes such as deleting malicious executables and scripts that were installed, restoring backup files, removing add-ons that were installed in browsers, etc. The researchers then create a script that will run on the affected device to implement the steps required to repair the infected device then the researcher remotely accesses the affected device, installs the script and runs the script on the protected device to remove the malicious software.

Abstract: A system and method for computer security of a protected device that has a processor and an operating system software running on the processor includes security software that runs on the protected device and has local data for control of the security software. Upon initialization of the security software, the security software loads the local data and periodically reads file-type associations from the operating system software. For each file-type association, the security software determines if that file type is permitted by the local data and if that file type is not permitted by the local data, the security software removes that file-type association from the operating system software.

Abstract: A computer security system with enhanced whitelisting includes administrative interfaces that accept user inputs to create and modify entries in a whitelist that define which programs are allowed to execute on one or more target computer systems. Upon an attempt to run a program, the entries in the whitelist are used to determine if the program is allowed to run. If an entry in the whitelist indicates that the program is allowed to run, the program is run. Otherwise, at a later time, an administrative interface is used to either block future execution of the program or to create an entry in the whitelist that allows execution of a class of programs or only that the program in the future until revoked. The whitelist is for a single target computer or many computers.

Abstract: A system for intelligent managing whitelists and blacklist provides options and/or suggestions to the administrators and/or information technology team to allow administration of whitelists and/or blacklists based upon history and rules. For example, if permission to run a certain program is requested by several people in a group or organization and the program is not believed to have a virus, then, the administrator if presented with an option to enable (e.g., add to the whitelist) that program for the entire group or organization.

Abstract: A computer security system with enhanced whitelisting includes user interfaces that accept user inputs to create and modify a set of rules that define which programs are allowed to execute on one or more target systems. Upon an attempt to run a program, the set of rules are used to determine if the program is allowed to run. If any rule indicates that the program is allowed to run, the program is run. Otherwise, a user interface is presented to either block execution of the program or to create a new rule that would allow execution of the program this time and in the future.

Abstract: A computer security system with enhanced blacklisting includes administrative interfaces that accept user inputs to create and modify entries in a blacklist and a whitelist that define which programs are allowed to execute on one or more target computer systems. Upon an attempt to run a program, if the program is in the blacklist and not in the white list, the program is prevented from running. If the program is prevented from running, at a later time, an administrative interface is used to either block future execution of the program or to create an entry in the whitelist that allows future execution of a class of programs or only that the program until revoked. The whitelists and blacklists are for a single target computer or many computers.

Abstract: A computer security system with enhanced whitelisting includes user interfaces that accept user inputs to create and modify a set of rules that define which programs are allowed to execute on one or more target systems. Upon an attempt to run a program, the set of rules are used to determine if the program is allowed to run. If any rule indicates that the program is allowed to run, the program is run. Otherwise, a user interface is presented to either block execution of the program or to create a new rule that would allow execution of the program this time and in the future.

Abstract: A computer security system with enhanced whitelisting includes administrative interfaces that accept user inputs to create and modify entries in a whitelist that define which programs are allowed to execute on one or more target computer systems. Upon an attempt to run a program, the entries in the whitelist are used to determine if the program is allowed to run. If an entry in the whitelist indicates that the program is allowed to run, the program is run. Otherwise, at a later time, an administrative interface is used to either block future execution of the program or to create an entry in the whitelist that allows execution of a class of programs or only that the program in the future until revoked. The whitelist is for a single target computer or many computers.

Abstract: A system and method of protecting a computer includes providing a whitelist of known applications and a set of rules for determining if a program is benign. Upon an attempt to initiate a program, determining if the program is in the whitelist and if the program is in the whitelist, allowing the program to run. If the program is not in the whitelist, determining if the program is benign based upon the set of rules or strategy and presenting the rule/strategy to the user. If the user accepts the rule/strategy, running the program and updating the whitelist for allowing future attempts to run the program and any other program that conforms to the one rule. If the program is not determined to be benign, the program is not allowed to execution unless a specific override is made.

Abstract: A system and method of protecting a computer includes providing a whitelist of known applications and a set of rules for determining if a program is benign. Upon an attempt to initiate a program, determining if the program is in the whitelist and if the program is in the whitelist, allowing the program to run. If the program is not in the whitelist, determining if the program is benign based upon the set of rules or strategy and presenting the rule/strategy to the user. If the user accepts the rule/strategy, running the program and updating the whitelist for allowing future attempts to run the program and any other program that conforms to the one rule. If the program is not determined to be benign, the program is not allowed to execution unless a specific override is made.

Abstract: A system for protecting against remote access protocol intrusions includes an intrusion detection module that monitors the remote desktop protocol of a target computer, looking for connections (or attempted connections) from a connecting device (e.g. a remote computer). Upon detecting the connection (or attempted connection), the intrusion detection module determines if the connecting device is authorized to make a remote desktop protocol connection to the target computer using, in some embodiments, white lists and/or black lists. In some embodiments, the intrusion detection module communicates with a verification program the must be run on the connecting device and tries to receive a packet containing an identification of the connecting device. If the packet is not received or the connecting device is not authorized, the intrusion detection module disconnects the connection from the connecting device.

Abstract: A system for computer security includes a device protected by the system for computer security having software running on the device that detects an attempt to run a script in a browser. Responsive to the attempt to run the script in the browser or a pattern of function calls made by the script, the software running on the device scans the script and/or monitors the function calls to determine if the script is an infinite alert. If the script is an infinite alert, the software running on the device prevents execution of the script or kills the script if it is already running. If the script is not an infinite alert, the software running on the device allows execution/completion of the script. Determining if the script includes an infinite alert includes, for example, a certain length of script or finding certain 800 numbers and/or specific keywords in the script.