Patent ID: 7475135

Claim:
A computer-method of event detection in computer systems, said method comprising the steps of: detecting an item of interest, wherein the item of interest is a browser highjacking; determining at least one event near in time to the item of interest in an effort to determine a probable cause of the item of interest, wherein said determining at least one event is undertaken via analyzing at least one event within a predetermined time threshold on at least one machine, wherein the at least one event is at least one browser request via file transfer protocol; creating an event log of events determined, wherein each event is classified by a type consisting of: information, warning, and error; correlating the at least one event with the item of interest, wherein said correlating consists of: analyzing at least one event and an item of interest of another user; and thereafter determining at least one probable cause of the item of interest, said step of determining at least one probable cause comprises testing a corrective method and ascertaining whether the corrective method corrects the item of interest on one or more machines; wherein a separate test computer plays back a sequence of events prior to an item of interest, to determine if the item of interest can be replicated, said separate test computer acts an automated fashion without human intervention; and wherein if a likely cause is not determined, then an event log of another computer is selected and scanned to determine a likely cause, this process of scanning event logs on other computers is repeated until a likely cause is determined; reporting the likely cause of an item of interest to a user; and taking corrective action, wherein corrective action is preventing the at least one item of interest from occurring again.