Automated detection and configuration of security domains

1. A method of protecting a computer system against malware with an anti-malware program, the method comprising:

automatically detecting an existence of a program present on the computer system;

determining a domain of the program by analyzing a configuration of the program, the domain comprising a set of files and/or memory that the program uses for its operation;

excluding the determined domain of the program from a security domain of the anti-malware program, the security domain for the anti-malware program describing areas of the computer system scanned by the anti-malware program for malware; and

scanning for malware in the security domain of the anti-malware program.

2. The method of claim 1 , wherein the computer system is remote from a second computer system on which the anti-malware program is installed.

3. The method of claim 1 , wherein the program is of a predetermined type, the predetermined type being at least one of security software and software that is known to be protected by software other than the anti-malware program, and wherein the domain of the program is excluded from the security domain responsive to the program being of the predetermined type.

4. The method of claim 1 , the automatically detecting comprising at least one of:

periodically detecting for the existence of the program;

detecting for the existence of the program in response to an occurrence of a predetermined event; and

detecting for the existence of the program at user-defined intervals.

5. The method of claim 1 , the determining comprising:

examining a file structure of a storage device associated with the computer system.

6. The method of claim 5 , the examining comprising at least one of:

performing a registry read;

querying a file directory structure;

reading a configuration file;

analyzing at least one open file handle of a running process of the program; and

querying an application program interface of the program.

7. The method of claim 1 , the excluding the domain comprising:

determining an overlap portion between the domain of the program and the security domain of the anti-malware program; and

excluding the overlap portion from the security domain.

8. The method of claim 1 , wherein the security domain of the anti-malware program initially covers the domain of the program and wherein the excluding restricts the domain of the program from the security domain.

9. A system for protecting a computer system against malware, comprising:

a non-transitory computer-readable storage medium having executable instructions stored therein, the instructions comprising:

a software detection module arranged to automatically detect for a predetermined type of software program present on the computer system;

a software domain detection module arranged to determine a domain of the software program by analyzing a configuration of the program, the domain comprising a set of files and/or memory that the program uses for its operation;

a domain exclusion module arranged to exclude the determined domain of the software program from a security domain of an anti-malware program, the security domain for the anti-malware program describing areas of the computer system scanned by the anti-malware program for malware; and

a malware scanning module arranged to scan the security domain of the anti-malware program for malware; and

a processor for executing the instructions.

10. The system of claim 9 , wherein the software program resides on a computer system remote from a computer system on which the anti-malware program resides.

11. The system of claim 9 , the software detection module further arranged to at least one of:

periodically detect for the software program;

detect for the software program in response to an occurrence of a predetermined event; and

detect for the software program at user-defined intervals.

12. The system of claim 9 , the software domain detection module further arranged to examine a file structure of a storage device associated with the computer system.

13. The system of claim 9 , the software domain detection module further arranged to at least one of:

perform registry reads and directory queries;

read a configuration file;

analyze at least one open file handle of a running process of the software program; and

query an application program interface of the software program.

14. The system of claim 9 , the computer-readable storage medium further comprising:

a malware definition/signature store arranged to store characteristics of known malware, wherein the malware scanning module uses characteristics stored in the malware definition/signature store; and

a malware remediation module arranged to remediate malware detected by the malware scanning module.

15. The system of claim 9 , wherein the software domain detection module is dependent on a network access control module, the network access control module arranged to store a configuration of a computer system on which the software program is installed.

16. The system of claim 9 , the domain exclusion module further arranged to determine an overlap portion between the domain of the software program and the security domain of an anti-malware program and exclude the overlap portion from the security domain.

17. The system of claim 9 , wherein the software program is at least one of security software and software known to be protected by software other than the anti-malware program.

18. A non-transitory computer-readable storage medium having executable instructions stored therein, the instructions comprising instructions to:

automatically detect a predetermined type of program present on a computer system;

determine a domain of the program by analyzing a configuration of the program, the domain comprising a set of files and/or memory that the program uses for its operation;

exclude the determined domain of the program from a security domain of an anti-malware program, the security domain for the anti-malware program describing areas of the computer system scanned by the anti-malware program for malware; and

scan for malware in the security domain of the anti-malware program.

19. The computer-readable medium of claim 18 , wherein the computer system is remote to a second computer system on which the anti-malware program is installed.

20. The computer-readable medium of claim 18 , further comprising instructions to at least one of:

periodically detect for the program;

detect for the program in response to an occurrence of a predetermined event; and

detect for the program at user-defined intervals.

21. The computer-readable medium of claim 18 , further comprising instructions to:

determine an overlap portion between the domain of the program and the security domain of the anti-malware program; and

exclude the overlap portion from the security domain.

22. The computer-readable medium of claim 18 , wherein the program is at least one of security software and software known to be protected by software other than the anti-malware program.