The present invention extends to methods, systems, and computer program products for scanning files for inappropriate content during file synchronization. Embodiments of the invention are mindful of the order of operations when scanning files for inappropriate content and in subsequent file processing. In some embodiments, during synchronization, an intermediary server scans a file for inappropriate content. The file is not permitted to be fully downloaded to a client device until the scan determines that the file does not contain inappropriate content. In other embodiments, during synchronization, a client device scans a newer version of a file for inappropriate content. An older version of the file is not deleted until the scan determines that the newer version of the file does not contain inappropriate content. In further embodiments, server side scanning and client side scanning are both used to enhance capabilities for detecting inappropriate content.

The present invention extends to methods, systems, and computer program products for reverse replication to rollback corrupted files. When a computer system detects that a copy of a file includes inappropriate content, the computer system can coordinate with other computer systems (e.g., in replicated storage system) to determine that a viable (e.g., clean) copy of the file exists. The computer system can access the viable copy and replace the copy that includes the inappropriate content with the viable copy. As such, a computer system can “reverse replicate” a file rather than break a synchronization relationship. Reverse replication can be used to rollback a copy of an infected file to another (possibly earlier) copy of the file that is not infected. Embodiments of the invention can be used to rollback data files, such as, for example, pictures, videos, documents, etc.

Described is a technology by which a malware-compromised machine, such as a personal computer is cleaned through the use of a functional adjunct machine, such as a mobile device (or vice-versa). The functional adjunct machine performs actions on behalf of the malware-compromised machine and/or to assist the remediation. This may include downloading antimalware-related data (e.g., an application, antimalware code, signature updates and/or the like) via a marketplace/application store, and transferring at least some of the data and/or programs to the compromised machine. Other actions may include using the functional adjunct machine to boot the malware-compromised machine into a non-compromised state and providing the data or programs to allow remediation of the malware while in this state.

In some embodiments, a local agent on a target system may evaluate current and/or historical system state information from a store (either local or remote) and dynamically adjust the level of diagnosis performed during the scan based on the evaluated state information. Individual diagnostic scans may, for example, be enabled and disabled based on the context in the store, and each scan may update the context for further evaluation. By employing such an approach, systems with a low risk profile and lacking symptoms of a problem may be scanned quickly while systems that show signs of a problem or have a high risk profile may receive a more thorough evaluation.

The subject disclosure is directed towards detecting malware or possible malware in an input file by allowing the input file to be opened, and by monitoring for one or more behaviors corresponding to the open file that likely indicate malware. Only certain executable files and/or file types opened thereby may be monitored, with various collected event data used for antimalware purposes when improper behavior is observed. Example behaviors include writing of a file to storage, generation of network traffic, injection of a process, running of script, and/or writing system registry data. Telemetry data and/or a sample of the file may be sent to an antimalware service, and malware remediation may be performed. Data (e.g., the collected events) may be distributed to other nodes for use in antimalware detection, e.g., to block execution of a similar file.

A system and method uses the closed captioning script to synchronize supplemental data with specified junctures in a video program. A parser parses the closed captioning script to identify a set of unique phrases, with each phrase having the same number of words. A program producer decides what points in the video program to introduce enhancing content. The producer associates supplemental data used to activate the enhancing content with specific key phrases of the closed captioning script that correspond to the desired points in the program. The parser creates a key phrase data file which contains a listing of the key phrases and their association to the supplemental data. The key phrase data file is delivered to viewer computing units at users' homes. When the program is played, the viewer computing unit monitors the closed captioning script to detect the key phrases listed in the key phrase data file. Upon detection of a particular key phrase, the viewer computing unit accesses the key phrase data file to retrieve the supplemental data associated with the particular key phrase. The viewer computing unit executes an enhancement action according to the supplemental data to synchronize the enhancement action with the video program. According to one implementation, the key phrase detector multicasts the enhancement action to a multicast address. A listener in the form of an ActiveX™ control listens to the multicast address to receive and handle any enhancement action supported by the supplemental data. The listener can be embedded in a container, such as an HTML page or other hypermedia document.

The dynamic conversion of a data structure from an origin data format into a destination data format is described. Instead of using a single data conversion module to accomplish this data conversion, a gateway computer system identifies a sequence of format conversion modules that, when executed in sequence, converts the data structure from the origin to the destination data format. The conversion occurs dynamically during run time and reduces the amount of needed data conversion modules significantly, particularly when there is a large amount of possible origin data formats and destination data formats. This conversion is particularly useful when communicating over wireless networks since there is little standardization in wireless devices resulting in wireless devices having many different proprietary data formats.

A flexible gateway accommodates data transfer from a data origination device over a wide variety of networks to a wide variety of destination devices, even if those networks use different protocols, and even if the devices recognize different data formats. Thus, the gateway can perform work previously requiring numerous gateways. After the gateway receives information from a data source, the gateway identifies the specific device type and the specific network type to which the information is to be routed. The gateway then calls device and network drivers associated with the specific device and network identified with the destination device. These drivers then manipulate the data using the device driver into the format recognized by the destination device, and then provide the manipulated data to the destination device over the identified network using the compatible protocol. Thus, the destination device properly receives and interprets the information provided by the data source. If, in the very next moment, data arrives at the gateway that is to be routed over a different network using a different protocol to a different device recognizing a different device, the gateway will call different device and network drivers to enable the communication.

Architecture for controlling access to a service. The architecture allows denial of regular and periodic service to all but a selected number of concurrent clients associated with a subscriber, and without any manual administration at the server of a list of specific computers. Rather than require an administered list, the system discovers which clients are active, places the active clients on an active list, and excludes all client not on the active list. The system includes rules the enforcement of which provide a mechanism for ensuring that the subscriber is not adding an unlimited number of clients or rotating clients in and out of the pool to effectively maintain service on a larger number of computers to which the subscriber is entitled.

A system and method uses a closed captioning script to synchronize supplemental data with specified junctures in a video program. A parser parses the closed captioning script to identify a set of unique key phrases. A producer associates the supplemental data with the key phrases of the closed captioning script that correspond to the desired points in the program. When the program is played, a viewer computing unit monitors the closed captioning script to detect the key phrases. Upon detection of a particular key phrase, the viewer computing unit retrieves the supplemental data associated with the particular key phrase. The supplemental data is multicast to a multicast address. A listener listens to the multicast address to receive and handle any enhancement action supported by the supplemental data. The listener can be embedded in a container, such as an HTML page or other hypermedia document.

The present invention is directed to a system and methods for protecting a limited resource computer from malware. Aspects of the present invention use antivirus software on a general purpose computer to prevent malware from infecting a limited resource computer. Typically, antivirus software on the general purpose computer is kept “up-to-date” with the most recent software updates. When a connection is established between the limited resource computer and the general purpose computer, a signature of each application installed on the limited resource computer is transmitted to the general purpose computer. Then antivirus software on the general purpose computer compares the received signatures to known malware. Finally, the results of the scan are reported to the limited resource computer.

An expert proxy server is described that is coupled to a number of wireless devices through a wireless network, and to a number of server computer systems through an external network such as, for example, the Internet. The expert proxy server acts as an agent for a wireless device by providing a service for the wireless device. Specifically, the expert proxy server determines that a service is to be provided to the wireless device. Next, the expert proxy server identifies an application that provides the service and then communicates with the identified application that provides the service. The expert proxy server compiles the results of the communication with the application and then transmits the compilation to the wireless device over the wireless network. Thus, the relatively smaller bandwidth of the wireless network is preserved by transmitting a minimal amount of information over the wireless network while leaving more extensive communications to occur over higher bandwidth external networks. Also, since the extensive processing occurs at the expert proxy server rather than at the wireless device, the application on the wireless device may be simplified and smaller as compared to the supporting applications on the expert proxy server thereby preserving the limited memory and processing capability of the wireless device.

The present invention provides a system, method, and computer-readable medium that opportunistically install a software update on a computer that closes a vulnerability that existed on the computer. In accordance with one aspect of the present invention, when antivirus software on a computer identifies malware, a method causes a software update that closes the vulnerability exploited by the malware to be installed on the computer. The method includes identifying the vulnerability exploited by the malware, using a software update system to obtain a software update that is configured to close the vulnerability; and causing the software update to be installed on the computer where the vulnerability exists.

In general, embodiments of the present invention provide protection for anti-malware software programs (also referred to herein as anti-malware) that is in addition to the protection that currently exists. In particular, instead of only protecting anti-malware programs from malware attacks by attempting to detect the malware software programs (also referred to herein as malware) before they can accomplish their malicious task, embodiments of the present invention obfuscate, or hide, the anti-malware and/or files associated with the anti-malware. Obfuscating files makes it difficult for malware to locate the information needed to accomplish its malware tasks. Additionally, because obfuscation makes file location difficult, malware that attempts to overcome this protection technique will likely include or use a detection engine.

Methods, systems, and computer program products for synchronizing data stored at one or more message clients with data stored at a message server where the message clients may receive update notifications and may represent the data using different data structures than the message server uses to represent the same data. A token is associated with each data change that occurs at the message server. The message server sends each change and associated token to the message clients. When the message clients request a synchronization, the tokens they received are returned to the message server for comparison with the tokens the message server sent to the message clients. If the message clients do not return a particular token, the message server determines that the clients did not receive the corresponding change and resends the change to the message clients. Tokens may also be used to divide a change into one or more portions, with only one portion being provided initially. Then, in response to receiving the token associated with the portion, the message server may provide the remaining portion of the message to the message clients.

Methods, systems, and computer program products for synchronizing data stored at one or more message clients with data stored at a message server where the message clients may receive update notifications and may represent the data using different data structures than the message server uses to represent the same data. A token is associated with each data change that occurs at the message server. The message server sends each change and associated token to the message clients. When the message clients request a synchronization, the tokens they received are returned to the message server for comparison with the tokens the message server sent to the message clients. If the message clients do not return a particular token, the message server determines that the clients did not receive the corresponding change and resends the change to the message clients. Tokens may also be used to divide a change into one or more portions, with only one portion being provided initially. Then, in response to receiving the token associated with the portion, the message server may provide the remaining portion of the message to the message clients.

PROBLEM TO BE SOLVED: To provide an architecture for controlling access to a service.

SOLUTION: This architecture allows denial of regular and periodic service to all but a selected number of concurrent clients associated with a subscriber, and without any manual administration at the server of a list of specific computers. Rather than require an administered list, the system discovers which clients are active, places the active clients on an active list, and excludes all client not on the active list. The system includes one or more rules of the enforcement which provide a mechanism for ensuring that the subscriber is not adding an unlimited number of clients or rotating clients in and out of the pool to effectively maintain service on a larger number of computers to which the subscriber is entitled.

COPYRIGHT: (C)2005,JPO&NCIPI

Methods, systems, and computer program products for caching content that has been customized based on one or more operating characteristics of a mobile client. A mobile gateway receives content from a content source and customizes the content using transforms assigned to each mobile client. Transforms account for differences between mobile clients without imposing significant processing burdens on the content server. Copies of the content, the transformed content, and a transform identifier are cached at the mobile gateway so that subsequent requests for the content may be satisfied without requiring access to the content source. Processing that is common among several transforms may be shared. Mobile clients may be any type of computer.

Methods, systems, and computer program products for customizing content based on at least one operating characteristic of a mobile client. A mobile gateway receives content from a content source, such as an email server, a Web server, or some other content server. For example, content may include email, calendar, contact, task, Web, notification, financial, sports data, configuration information, etc. The mobile gateway customizes the content based on transforms assigned to each mobile client. Transforms account for differences in the software, display, processor, memory, communication channel, and the like, of each mobile client, without imposing additional processing burdens on the content server. Processing that is common among several transforms may be shared. Mobile clients may be any type of computer, including telephones, pagers, PDAs, laptops, and other mobile gateways.

Methods, systems, and computer program products for negotiating a secure end-to-end connection using a proxy server as an intermediary. The client first negotiates a secure connection between the client and the proxy so that any credentials exchanged will be encrypted. After the exchange of authentication credentials, the secure client-proxy connection is altered so that no further encryption takes place. The client and server then negotiate a secure end-to-end connection through the proxy, with the secure end-to-end connection being encapsulated within the insecure client-proxy connection. In this way, the overhead of creating a separate client-proxy connection for the secure end-to-end connection may be avoided, but the insecure client-proxy connection introduces only minimal overhead because it no longer encrypts any data that it carries.

In accordance with the present invention, a system, method, and computer-readable medium for identifying malware at a network transit point such as a computer that serves as a gateway to an internal or private network is provided. A network transmission is scanned for malware at a network transit point without introducing additional latency to the transmission of data over the network. In accordance with one aspect of the present invention, a computer-implemented method for identifying malware at a network transit point is provided. More specifically, when a packet in a transmission is received at the network transit point, the packet is immediately forwarded to the target computer. Simultaneously, the packet and other data in the transmission are scanned for malware by an antivirus engine. If malware is identified in the transmission, the target computer is notified that the transmission contains malware.

PURPOSE: A server architecture for controlling access to a service by concurrent clients is provided to disallow a periodical and cyclic service to all clients, not concurrent clients of a selected number related to a subscriber, without any manual management in a server of a computer list.

CONSTITUTION: A rule component(108) processes more than one rule according to a subscribed service of a subscriber client(104). A service component(102) automatically constrains the subscribed service partially according to the concurrent client number of the subscriber client by using more than one rule. The rule automatically constrains the subscribed service according to at least one of a churn parameter or a frequency parameter. Each concurrent client includes a cookie facilitating constraint of the subscribed service.

© KIPO 2006

The present invention provides a system, method, and computer-readable medium for identifying and removing active malware from a computer. Aspects of the present invention are included in a cleaner tool that may be obtained automatically with an update service or may be downloaded manually from a Web site or similar distribution system. The cleaner tool includes a specialized scanning engine that searches a computer for active malware. Since the scanning engine only searches for active malware, the amount of data downloaded and resource requirements of the cleaner tool are less than traditional antivirus software. The scanning engine searches specific locations on a computer, such as data mapped in memory, configuration files, and file metadata for data characteristic of malware. If malware is detected, the cleaner tool removes the malware from the computer.