Alerting the presence of bundled software during an installation

• US 10,089,095 B2
• Filed: 05/06/2015
• Issued: 10/02/2018
• Est. Priority Date: 05/06/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Giri, Babu Nath, Ramagopal, Prashanth P., Thomas, Vinoo
• Primary Examiner(s): Jeon, Jae
• Application Number:
  US14/705,662
• Publication Number:
  US 20160328223A1
• Time in Patent Office: 1,245 Days
• Field of Search: 717174-178
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 9/453 Help systems
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

A technique allows a user client to receive a software product from a server. The user client may determine if the software product includes other potentially unwanted programs by reading one or more graphical user interface instances that are created during installation of the software product. The graphical user interface instances are read to identify information related to software identifiers of the software product and of potentially unwanted programs. A signature file may be received from a third-party server. The software identifiers of the software product and potentially unwanted programs can be checked against the signature file during installation of the software product in order to identify the presence of potentially unwanted programs that may be bundled with software product.

Claims

1. A non-transitory machine readable medium, on which instructions are stored, comprising the instructions that, when executed by a processor, cause a machine to:

receive a signature file that includes data that identifies intended software products, bundled software products, or both;

identify an instance of an initiated software process that installs a software product;

scan, after identifying the initiated software process and prior to completing the initiated software process, the software product during the initiated software process to identify first information, wherein the first information includes extracted information from files associated with the software product that are indicative of a main application to be installed as part of the software product;

continue scanning a second instance of information displayed to a user during the initiated software process to identify second information;

compare the first information with the second information identified from the second instance of information displayed to the user;

identify, after identifying the initiated software process, whether any bundled application to be installed is included within the software product based on comparing the first information with the second information;

determine, after comparing the first information with the second information, whether any bundled application is included in the software product based on comparing the first information and the second information to the signature file;

compare the first information and the second information to the signature file based on a determination that the bundled application is not identified within the software product after comparing the first information with the second information;

identify whether the bundled application is included in the software product based on the comparison of the first and the second information to the signature file;

install the main application responsive to a determination that no bundled application is included in the software product; and

automatically halt, after identifying the initiated software process, installation of the main application and the bundled application, based on the a determination that the bundled application is included within the software product.

2. The non-transitory machine readable medium of claim 1, wherein the instructions further comprise instructions that, when executed, cause the machine to display an alert on an user interface responsive to identifying that the software product includes the bundled application.

3. The non-transitory machine readable medium of claim 1, wherein the first information includes textual information displayed to the user as part of the initiated software process.

4. The non-transitory machine readable medium of claim 1, wherein the first information includes information from a graphical user interface (GUI) instance, and wherein the instructions to identify the first information further comprise instructions that, when executed, cause the machine to read textual information within a license agreement displayed in the GUI instance.

5. The non-transitory machine readable medium of claim 1, wherein the first information includes information from a graphical user interface (GUI) instance, and wherein the instructions to identify the first information further comprise instructions that, when executed, cause the machine to extract GUI objects and non-textual material within the GUI instance.

6. The non-transitory machine readable medium of claim 1, wherein the instructions further comprise instructions that, when executed, cause the machine to receive the signature file from a server.

7. The non-transitory machine readable medium of claim 1, wherein the extracted information included in the first information comprises a software identifier for the main application.

8. The non-transitory machine readable medium of claim 1, wherein the second information comprises a name for the bundled application.

9. A computer system for detecting bundled software during installation of a software product, comprising:

one or more processors; and

a memory coupled to the one or more processors, on which instructions are stored, comprising the instructions that, when executed, cause one or more of the processors to;

receive a signature file that includes data that identifies intended software products, bundled software products, or both;

identify an instance of an initiated software process that installs a software product;

scan, after identifying the initiated software process and prior to completing the initiated software process, the software product during the initiated software process to identify first information, wherein the first information includes extracted information from files associated with the software product that are indicative of a main application to be installed as part of the software product;

continue scanning a second instance of information displayed to a user when executing the initiated software process to identify second information;

compare the first information with the second information identified from the second instance of information displayed to the user;

identify, after identifying the initiated software process, whether any bundled application to be installed is included within the software product based on comparing the first information with the second information;

determine, after comparing the first information with the second information, whether any bundled application is included in the software product based on comparing the first information and the second information to the signature file;

compare the first information and the second information to the signature file based on a determination that the bundled application is not identified within the software product after comparing the first information with the second information;

identify whether the bundled application is included in the software product based on the comparison of the first and the second information to the signature file;

install the main application responsive to a determination that no bundled application is included in the software product; and

automatically halt, after identifying the initiated software process, installation of the main application and the bundled application, based on a determination that the bundled application is included within the software product.

10. The computer system of claim 9, wherein the first information includes textual information displayed to the user as part of the initiated software process.

11. The computer system of claim 9, wherein the instructions further comprise instructions that, when executed, cause the one or more of the processors to display an alert on an user interface responsive to identifying that the software product includes the bundled application.

12. The computer system of claim 9, wherein the first information includes information from a graphical user interface (GUI) instance, and wherein the instructions further comprise instructions that, when executed, cause the one or more of the processors to read textual information within a license agreement displayed in the GUI instance.

13. The computer system of claim 9, wherein the first information includes information from a graphical user interface (GUI) instance, and wherein the instructions further comprise instructions that, when executed, cause the one or more of the processors to extract GUI objects and non-textual material within the GUI instance.

14. The computer system of claim 9, wherein the instructions further comprise instructions that, when executed, cause the one or more of the processors to receive the signature file from a server.

15. The computer system of claim 9, wherein the first information comprises a software identifier for the main application.

16. The computer system of claim 9, wherein the second information comprises a name for the bundled application.

17. The computer system of claim 9, wherein the instructions further comprise instructions that, when executed, cause the one or more of the processors to transmit the first information to a server.

18. The computer system of claim 17, wherein the instructions further comprise instructions that, when executed, cause the one or more of the processors to receive information related to identifying that the bundled application is not to be installed with the software product responsive to transmitting the first information to the server.

19. A method for detecting bundled software during installation of a software product, comprising:

obtaining, at a client device, a signature file that includes data that identifies intended software products, bundled software products, or both;

identifying, at the client device, an instance of an initiated software process that installs a software product;

scanning, after identifying the initiated software process and prior to completing the initiated software process on the client device, the software product during the initiated software process to identify first information, wherein the first information includes extracted information from files associated with the software product that are indicative of a main application to be installed as part of the software product;

continuing to scan at the client device, a second instance of information displayed to a user during the initiated software process to identify second information;

comparing, at the client device, the first information with the second information identified from the second instance of information displayed to the user;

identifying, after identifying the initiated software process at the client device, whether any bundled application to be installed is included within the software product based on comparing the first information with the second information;

determining, after comparing the first information with the second information, whether any bundled application is included in the software product based on comparing the first information and the second information to the signature file;

comparing the first information and the second information to the signature file based on a determination that the bundled application is not identified within the software product after comparing the first information with the second information;

identifying whether the bundled application is included in the software product based on the comparison of the first and the second information to the signature file;

installing the main application responsive to a determination that no bundled application is included in the software product; and

halting automatically, after identifying the initiated software process at the client device, installation of the main application and the bundled application, based on a determination that any bundled application is included within the software product.

20. The method of claim 19, wherein the signature file includes blacklisted and whitelisted information indicative of applications that are identified as malware software applications.

21. The method of claim 19, wherein the second information includes information from a graphical user interface (GUI) instance, and wherein the second information comprises a name for the bundled application obtained in text information found within the GUI instance displayed on the client device.

22. The method of claim 19, wherein the first information includes information from a graphical user interface (GUI) instance, and wherein the first information comprises a software identifier for the main application obtained in text information found within a license agreement displayed in the GUI instance displayed on the client device.

23. A method for detecting bundled software during installation of a software product, comprising:

receiving, by a device, a signature file that includes data that identifies intended software products, bundled software products, or both;

initiating, by the device, an installation operation to install a main software product;

monitoring, by the device, the installation operation to extract one or more first software identifiers indicative of the main software product at a step in time in the installation operation, wherein the first software identifiers are extracted from files associated with the main software product;

storing the first software identifiers into memory of the device;

monitoring, by the device, the installation operation to flag one or more second software identifiers at a subsequent step in the installation operation;

determining, by the device, whether the second software identifiers correspond to a bundled software product based on a comparison of the second software identifiers and the first software identifiers, wherein the bundled software product is presented to install within the installation operation that installs the main software product onto the device;

determining, after comparing the first software identifiers and the second software identifiers, whether the bundled software product is presented to install within the installation operation that installs the main software product based on comparing the first software identifiers and the second software identifiers to the signature file;

comparing the first information and the second information to the signature file based on a determination that the bundled application is not identified within the software product after comparing the first information with the second information;

identifying whether the bundled application is included in the software product based on the comparison of the first and the second information to the signature file;

installing the main software produce responsive to a determination that no bundled software product is presented to install within the installation operation that installs the main software product; and

halting automatically, prior to installing the bundled software product and the main software product, the installation operation based on a determination that the bundled software product is presented to install within the installation operation that installs the main software product.

24. The method of claim 23, wherein the first software identifiers and the second software identifiers are extracted from information presented to a user on a displayed device.

25. The method of claim 23, further comprising:

obtaining, at the device, the signature file from a remote device.