Spencer V Smith

US Patent:

7926106, Apr 12, 2011

Filed:

Apr 6, 2006

Appl. No.:

11/400538

Inventors:

Mark Kennedy - Redondo Beach CA, US
Michael Spertus - Chicago IL, US
Peter Linhardt - Malibu CA, US
Richard Gough - Torrance CA, US
Adam Glick - Culver City CA, US
Patrick Gardner - Northridge CA, US
Spencer Smith - Sherman Oaks CA, US
Tim Naftel - Longmont CO, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 11/00

US Classification:

726 22, 726 23, 726 24, 726 25, 726 27, 713 1, 713 2, 713165, 713166, 713167

Abstract:

Upon detection of a rootkit, a host computer system is rebooted. The boot process is interrupted. Access to a media, e. g. , a volume or disk, containing the rootkit is gained and the media is directly accessed. The rootkit is disabled, e. g. , renamed or deleted, and the host computer system is rebooted a second time. If the rootkit has not been previously removed, e. g. , only renamed, the rootkit is removed, e. g. , using a conventional antivirus application. Thus, upon detection of a rootkit, the rootkit is removed without a clean boot.

US Patent:

8015221, Sep 6, 2011

Filed:

Nov 10, 2008

Appl. No.:

12/268256

Inventors:

Spencer Smith - El Segundo CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 17/30

US Classification:

707825, 707999203

Abstract:

A method for maintaining file-type information for a file is described. Data in a first position of a file is analyzed. A file-type for the file is determined based on the analyzed data in the first position. The file is monitored for input/output operations. The file-type of the file is updated if input/output operations occur within the first position of the file.

US Patent:

8161556, Apr 17, 2012

Filed:

Dec 17, 2008

Appl. No.:

12/336959

Inventors:

Spencer Smith - El Segundo CA, US
Haik Mesropian - Glendale CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G08B 23/00
G06F 12/14

US Classification:

726 24

Abstract:

A computer-implemented method for determining, in response to an event of interest, whether to perform a real-time file scan by examining the full context of the event of interest may comprise: 1) detecting an event of interest, 2) identifying at least one file associated with the event of interest, 3) accessing contextual metadata associated with the event of interest, 4) accessing at least one rule that comprises criteria for determining, based on the event of interest and the contextual metadata, whether to perform a security scan on the file, and then 5) determining, by applying the rule, whether to perform the security scan on the file. Corresponding systems and computer-readable media are also disclosed.

US Patent:

8204907, Jun 19, 2012

Filed:

Nov 10, 2008

Appl. No.:

12/268253

Inventors:

Spencer Smith - El Segundo CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 17/30

US Classification:

707783, 707705

Abstract:

A method for managing file access history information is described. An application opening a file is identified. Access rights used to open the file are determined. A time parameter associated with the opening of the file is recorded. An access frequency parameter for the file over a predetermined period of time is calculated. File access history information associated with the file is stored.

US Patent:

8336100, Dec 18, 2012

Filed:

Aug 21, 2009

Appl. No.:

12/545527

Inventors:

Adam Glick - Culver City CA, US
Nicholas Graf - Culver City CA, US
Spencer Smith - El Segundo CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 21/00

US Classification:

726 23, 726 22, 726 24, 713150, 713152, 713153, 713154, 713155, 713156, 713157, 713158, 713159, 713160, 713161, 713162, 713163, 713164, 713165, 713166, 713167, 713168, 713169, 713170, 713171, 713172, 713173, 713174, 713175, 713176, 713177, 713178, 713179, 713180, 713181

Abstract:

A computer-implemented method for using reputation data to detect packed malware may include: 1) identifying a file downloaded from a portal, 2) determining that the file has been packed, 3) obtaining community-based reputation data for the file, 4) determining, by analyzing the reputation data, that instances of the file have been encountered infrequently (or have never been encountered) within the community, and then 5) performing a security operation on the file (by, for example, quarantining or deleting the file).

US Patent:

8418223, Apr 9, 2013

Filed:

Jul 19, 2010

Appl. No.:

12/838938

Inventors:

Spencer Smith - El Segundo CA, US
Adam Glick - Culver City CA, US
Nicholas Graf - Culver City CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 17/00
G06F 15/16

US Classification:

726 1, 726 2, 726 3, 726 4, 726 6, 726 26, 726 27, 726 28, 713 1, 713100, 434118, 434365

Abstract:

A computer-implemented method may include establishing, within a parental-control software system, an academic-performance policy that defines how academic performance of a student affects at least one parental-control setting enforced on a computing system accessible to the student. The computer-implemented method may also include receiving, via an electronic communication from a school of the student, grade information that indicates the student's academic performance. The computer-implemented method may further include applying the academic-performance policy by updating the parental-control setting commensurate with the student's academic performance. In addition, the computer-implemented method may include detecting an attempt by the student to access a resource of the computing system and applying the updated parental-control setting to control the student's access to the resource of the computing system.

US Patent:

8549626, Oct 1, 2013

Filed:

Mar 20, 2009

Appl. No.:

12/407903

Inventors:

Adam Lyle Glick - Culver City CA, US
Spencer Dale Smith - El Segundo CA, US
Nicholas Robert Graf - Culver City CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 21/00

US Classification:

726 22, 726 25, 726 26, 718100, 709203

Abstract:

A method and apparatus for securing a computer from malicious threats through generic remediation is described. In one embodiment, the method for securing a computer from malicious threats through generic remediation includes processing at least one malicious threat to the computer, wherein the at least one malicious threat is not associated with a specific remediation technique and examining information regarding prior remediation of the at least one malicious threat by at least one computer to determine at least one remediation technique for the at least one malicious threat.

US Patent:

8566950, Oct 22, 2013

Filed:

Feb 15, 2010

Appl. No.:

12/705867

Inventors:

Spencer Dale Smith - El Segundo CA, US
Adam Lyle Glice - Culver City CA, US
Nicholas Robert Graf - Culver City CA, US

Assignee:

Symantec Corporation - Mountain View CA

International Classification:

G06F 21/00

US Classification:

726 26, 726 22, 726 23, 726 24, 726 25, 705 51, 713189, 713190, 713191, 713192, 713193, 713194, 713187, 717168, 717169, 717170, 717171, 717172, 717173, 717174, 717175, 717176, 717177, 717178

Abstract:

A method and apparatus for detecting potentially misleading visual representation objects to secure a computer is described. In one embodiment, the method includes monitoring visual representation object creation with respect to the browser, accessing verification information, wherein the verification information comprises commonly used user interface elements for forming legitimate system messages, examining web data associated with the created visual representation objects, wherein the web data is compared with the verification information to identify imitating content within the created visual representation objects and modifying at least one of the created visual representation objects to accentuate the imitating content.