Patent ID: 7533131

Claim:
A method of managing pestware on a protected computer, the method comprising: receiving a plurality of definitions corresponding to pestware; scanning the storage systems of the protected computer for files corresponding to any of the plurality of definitions; responsive to determining that one of the files matches one of the plurality of definitions, preventing the file from operating; detecting an initial pestware activity on the protected computer based on at least one of comparing data with a predetermined pestware definition and identifying pestware-related behavior on the protected computer; blocking the initial pestware activity; detecting a second pestware activity on the protected computer based on at least one of comparing data with a predetermined pestware definition and identifying pestware-related behavior on the protected computer; determining that the second pestware activity is similar to the initial pestware activity; responsive to determining that the second pestware activity is similar to the initial pestware activity, sending data about the protected computer and the second pestware activity to a host system; receiving a new definition from the host system, the new definition corresponding to the second pestware activity and generated using the sent data about the protected computer and the second pestware activity; scanning the storage systems of the protected computer for files corresponding to the new definition; and taking corrective action to protect the protected computer from at least one detected file corresponding to the new definition.