Alerting the presence of bundled software during an installation

• US 10,521,212 B2
• Filed: 03/11/2019
• Issued: 12/31/2019
• Est. Priority Date: 05/06/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Giri, Babu Nath, Ramagopal, Prashanth P., Thomas, Vinoo
• Primary Examiner(s): Jeon, Jae U
• Application Number:
  US16/298,711
• Publication Number:
  US 20190272163A1
• Time in Patent Office: 295 Days
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 9/453 Help systems
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Methods, apparatus, systems, and articles of manufacture for alerting the presence of bundled software during an installation are disclosed. An example method includes identifying installation of a software product. The software product is scanned to identify first information, the first information to include information extracted from a file associated with the software product that is indicative of a main application to be installed as part of the software product. Information displayed to a user during the installation of the software product is scanned to identify second information. Whether a bundled application is included in the software product is identified based on the first information, the second information, and the signature file.

Claims

1. At least one storage device that is not a propagating signal, the at least one storage device comprising instructions that, when executed by at least one processor, cause the at least one processor to at least:

identify initiation of a process for installing a software product;

scan the software product, after identifying the initiation of the process and prior to completing the installation of the software product, to identify first information, the first information from a file associated with the software product, the first information indicative of a main application to be installed as part of the software product;

scan information displayed to a user during the installation of the software product to identify second information;

identify whether a bundled application is included in the software product based on the first information, the second information, and a signature file, wherein the signature file includes information indicative of applications that are identified as malware software applications;

install the main application responsive to a determination that the bundled application is not included in the software product; and

halt installation of the main application and the bundled application, responsive to a determination that the bundled application is included in the software product.

2. The at least one storage device of claim 1, wherein the instructions, when executed, cause the at least one processor to initiate an alert on a user interface responsive to identifying that the software product includes the bundled application.

3. The at least one storage device of claim 1, wherein the first information includes text to be displayed to the user.

4. The at least one storage device of claim 1, wherein the first information includes information from a graphical user interface (GUI), and the instructions, when executed, cause the at least one processor to identify the first information based on text within a license agreement displayed in the GUI.

5. The at least one storage device of claim 1, wherein the first information includes information from a graphical user interface (GUI), and the instructions, when executed, cause the at least one processor to identify the first information by extracting GUI objects and non-textual material from the GUI.

6. The at least one storage device of claim 1, wherein the instructions, when executed, cause the at least one processor to access the signature file from a server.

7. The at least one storage device of claim 1, wherein the first information includes a software identifier for the main application.

8. The at least one storage device of claim 1, wherein the second information includes a name for the bundled application.

9. A computer system comprising:

one or more processors; and

memory including instructions which, when executed, cause at least one of the one or more processors to;

identify execution of a process that installs a software product;

scan the software product, prior to completing the execution of the process, to identify first information, the first information extracted from a file associated with the software product, the first information indicative of a main application to be installed as part of the software product;

scan second information displayed to a user during installation of the software product;

identify whether a bundled application is included within the software product based on the first information, the second information, and a signature file, wherein the signature file includes information indicative of applications that are identified as malware software applications;

install the main application responsive to a determination that the bundled application is not included in the software product; and

halt installation of the main application and the bundled application, in response to a determination that the bundled application is included in the software product.

10. The computer system of claim 9, wherein at least one of the first or the second information includes text.

11. The computer system of claim 9, wherein at least one of the one or more processors is to initiate display of an alert to identify that the software product includes the bundled application.

12. The computer system of claim 9, wherein the first information includes information from a graphical user interface (GUI), and at least one of the one or more processors is to access text within a license agreement.

13. The computer system of claim 9, wherein the first information includes information from a graphical user interface (GUI) instance, and at least one of the one or more processors is to extract GUI objects and non-textual material from the GUI.

14. The computer system of claim 9, wherein at least one of the one or more processors is to request the signature file from a server.

15. The computer system of claim 9, wherein the first information includes a software identifier for the main application.

16. The computer system of claim 9, wherein the second information includes a name for the bundled application.

17. The computer system of claim 9, wherein at least one of the one or more processors is to transmit at least one of the first information or the second information to a server.

18. The computer system of claim 17, wherein at least one of the one or more processors is to at least receive information related to identifying that the bundled application is not to be installed with the software product responsive to transmitting the first information to the server.

19. A method comprising:

identifying, at a client device, execution of a process to install a software product;

scanning, prior to completing the installation of the software product on the client device, the software product to identify first information, the first information to include information extracted from a file associated with the software product that is indicative of a main application to be installed as part of the software product;

scanning, at the client device, second information displayed to a user during the installation of the software product;

identifying whether a bundled application is included in the software product based on the first information, the second information, and a signature file, wherein the signature file includes information indicative of applications that are identified as malware software applications;

installing the main application in response to a determination that the bundled application is not included in the software product; and

halting installation of the main application and the bundled application, in response to a determination that the bundled application is included in the software product.

20. The method of claim 19, wherein the signature file includes blacklisted and whitelisted information.

21. The method of claim 19, wherein at least one of the first or the second information includes text.

22. The method of claim 19, further including initiating display of an alert to identify that the software product includes the bundled application.

23. The method of claim 19, wherein the first information includes information from a graphical user interface (GUI), and the method further includes accessing text within a license agreement.

24. The method of claim 19, wherein the first information includes information from a graphical user interface (GUI) instance, and the method further includes extracting GUI objects and non-textual material from the GUI.

25. The method of claim 19, further including requesting the signature file from a server.

26. The method of claim 19, wherein the first information includes a software identifier for the main application.

27. The method of claim 19, wherein the second information includes a name for the bundled application.

28. The method of claim 19, further including transmitting at least one of the first information or the second information to a server.

29. The method of claim 28, further including accessing information related to identifying that the bundled application is not to be installed with the software product responsive to transmitting the first information to the server.