Alerting the presence of bundled software during an installation

• US 10,255,053 B2
• Filed: 08/10/2018
• Issued: 04/09/2019
• Est. Priority Date: 05/06/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Giri, Babu Nath, Ramagopal, Prashanth P., Thomas, Vinoo
• Primary Examiner(s): Jeon, Jae U
• Application Number:
  US16/101,159
• Publication Number:
  US 20180349123A1
• Time in Patent Office: 242 Days
• Field of Search: 717174-178
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 9/453 Help systems
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Methods, apparatus, systems, and articles of manufacture for alerting the presence of bundled software during an installation are disclosed. An example method includes identifying installation of a software product. The software product is scanned to identify first information, the first information to include information extracted from a file associated with the software product that is indicative of a main application to be installed as part of the software product. Information displayed to a user during the installation of the software product is scanned to identify second information. Whether a bundled application is included in the software product is identified based on the first information, the second information, and the signature file.

Claims

1. At least one storage device that is not a propagating signal, the at least one storage device comprising instructions that, when executed by at least one processor, cause the at least one processor to at least:

identify an instance of a process for installing a software product;

scan, after identifying the process and prior to completing the installation of the software product, the software product to identify first information, the first information from a file associated with the software product, the first information indicative of a main application to be installed as part of the software product;

scan information displayed to a user during the installation of the software product to identify second information;

compare the first information and the second information to a signature file based on a determination that a bundled application is not identified within the software product;

identify whether the bundled application is included in the software product based on the first information, the second information, and the signature file, wherein the second information includes information from a graphical user interface (GUI), and the instructions cause the at least one processor to identify the second information by extracting GUI objects and non-textual material from the GUI;

install the main application responsive to a determination that the bundled application is not included in the software product; and

automatically halt installation of the main application and the bundled application, responsive to a determination that the bundled application is included in the software product.

2. The at least one storage device of claim 1, wherein the instructions, when executed, cause the at least one processor to initiate an alert on a user interface responsive to identifying that the software product includes the bundled application.

3. The at least one storage device of claim 1, wherein the first information includes textual information to be displayed to the user as part of the initiated software process.

4. The at least one storage device of claim 1, wherein the first information includes information from a graphical user interface (GUI), and the instructions cause the at least one processor to identify the first information by reading textual information within a license agreement displayed in the GUI.

5. The at least one storage device of claim 1, wherein the first information includes information from a graphical user interface (GUI), and the instructions cause the at least one processor to identify the first information by extracting GUI objects and non-textual material from the GUI.

6. The at least one storage device of claim 1, wherein the instructions, when executed, cause the at least one processor to access the signature file from a server.

7. The at least one storage device of claim 1, wherein the first information includes a software identifier for the main application.

8. The at least one storage device of claim 1, wherein the second information includes a name for the bundled application.

9. A computer system comprising:

one or more processors; and

memory including instructions which, when executed, cause at least one of the one or more processors to at least;

identify an initiated software process that installs a software product;

scan, prior to completing the initiated software process, the software product to identify first information, the first information extracted from a file associated with the software product, the first information indicative of a main application to be installed as part of the software product;

scan information displayed to a user during installation of the software product to identify second information;

compare the first information and the second information to a signature file based on a determination that a bundled application is not identified within the software product;

identify whether the bundled application is included within the software product based on the first information, the second information, and the signature file, wherein the second information includes information from a graphical user interface (GUI), and the instructions cause the one or more processors to identify the second information by extracting GUI objects and non-textual material from the GUI;

install the main application responsive to a determination that the bundled application is not included in the software product; and

halt installation of the main application and the bundled application, in response to a determination that the bundled application is included in the software product.

10. The computer system of claim 9, wherein the first information includes textual information displayed to the user when installing the software product.

11. The computer system of claim 9, wherein the at least one of the one or more processors is to initiate display of an alert to identify that the software product includes the bundled application.

12. The computer system of claim 9, wherein the first information includes information from a graphical user interface (GUI), and at least one of the one or more processors is to read textual information within a license agreement.

13. The computer system of claim 9, wherein the first information includes information from a graphical user interface (GUI) instance, and at least one of the one or more processors is to extract GUI objects and non-textual material from the GUI.

14. The computer system of claim 9, wherein at least one of the one or more processors is to request the signature file from a server.

15. The computer system of claim 9, wherein the first information includes a software identifier for the main application.

16. The computer system of claim 9, wherein the second information includes a name for the bundled application.

17. The computer system of claim 9, wherein at least one of the one or more processors is to transmit the first information to a server.

18. The computer system of claim 17, wherein at least one of the one or more processors is to at least receive information related to identifying that the bundled application is not to be installed with the software product responsive to transmitting the first information to the server.

19. A method comprising:

identifying, at a client device, installation of a software product;

scanning, prior to completing the installation of the software product on the client device, the software product to identify first information, the first information to include information extracted from a file associated with the software product that is indicative of a main application to be installed as part of the software product;

scanning, at the client device, information displayed to a user during the installation of the software product to identify second information;

comparing the first information and the second information to a signature file based on a determination that a bundled application is not identified within the software product;

identifying whether the bundled application is included in the software product based on the first information, the second information, and the signature file, wherein the second information includes information from a graphical user interface (GUI), and the instructions cause the at least one processor to identify the second information by extracting GUI objects and non-textual material from the GUI;

installing the main application in response to a determination that the bundled application is not included in the software product; and

halting installation of the main application and the bundled application, in response to a determination that the bundled application is included in the software product.

20. The method of claim 19, wherein the signature file includes blacklisted and whitelisted information indicative of applications that are identified as malware software applications.