Validating computer program installation

• US 20030192033A1
• Filed: 04/04/2002
• Published: 10/09/2003
• Est. Priority Date: 04/04/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Harris, Mark, Gartside, Paul Nicholas
• Granted Patent: US 7,810,091 B2
• Time in Patent Office: Days
• US Class Current: 717/126
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 8/61 Installation

Abstract

The installation of a computer program, such as a malware scanner, may be checked to determine whether or not it has not been tampered with using an installation checking computer program to gather characteristics of the installation of the target computer program after the installation checking computer program has first been validated by a separate further computer. The installation characteristics may include operating system registry entries, installed files list, file sizes and file checksums.

Claims

1. A computer program product for validating an installation of a target computer program on a target computer, said computer program product comprising:

installation checking code validated with a further computer connected by a network link to said target computer and operable to execute upon said target computer to gather characteristics of said installation of said target computer program upon said target computer;

comparing code operable to comparing said gathered characteristics with predetermined valid characteristics;

response code operable if said gathered characteristics match said predetermined valid characteristics to trigger an installation valid response and operable if said gathered characteristics do not match said predetermined valid characteristics to trigger an installation invalid response.

2. A computer program product as claimed in claim 1, wherein said installation checking code is validated by being securely stored on said further computer and transferred from said further computer to said target computer before being executed on said target computer.

3. A computer program product as claimed in claim 1, wherein said installation checking code is stored on said target computer and is validated by sending a secure key to said further computer.

4. A computer program product as claimed in claim 1, wherein validation of said installation is triggered by a user input.

5. A computer program product as claimed in claim 1, wherein validation of said installation is triggered when said target computer connects to a network.

6. A computer program product as claimed in claim 5, wherein a login script for said target computer starts execution of said installation checking computer program.

7. A computer program product as claimed in claim 1, wherein said characteristics of said installation include one or more of:

operating system registry entries for said target computer program;

a list of files stored in a program file directory of said target computer program;

one or more file size values associated with one or more files of said target computer program; and

one or more checksum values associated with one or more files of said target computer program.

8. A computer program product as claimed in claim 1, wherein said target computer program is a malware scanning computer program.

9. A computer program product as claimed in claim 8, wherein said malware scanning computer program scans for one or more of:

computer viruses;

worms;

Trojans;

banned files;

banned words; and

banned images.

10. A computer program product as claimed in claim 1, wherein said predetermined valid characteristics are store on said further computer.

11. A method of validating an installation of a target computer program on a target computer, said method comprising the steps of:

validating security of an installation checking computer program with a further computer connected by a network link to said target computer;

executing said installation checking computer program upon said target computer to gather characteristics of said installation of said target computer program upon said target computer;

comparing said gathered characteristics with predetermined valid characteristics;

if said gathered characteristics match said predetermined valid characteristics, then triggering an installation valid response; and

if said gathered characteristics do not match said predetermined valid characteristics, then triggering an installation invalid response.

12. A method as claimed in claim 11, wherein said installation checking computer program is validated by being securely stored on said further computer and transferred from said further computer to said target computer before being executed on said target computer.

13. A method as claimed in claim 11, wherein said installation checking computer program is stored on said target computer and is validated by sending a secure key to said further computer.

14. A method as claimed in claim 11, wherein validation of said installation is triggered by a user input.

15. A method as claimed in claim 11, wherein validation of said installation is triggered when said target computer connects to a network.

16. A method as claimed in claim 15, wherein a login script for said target computer starts execution of said installation checking computer program.

17. A method as claimed in claim 11, wherein said characteristics of said installation include one or more of:

operating system registry entries for said target computer program;

a list of files stored in a program file directory of said target computer program;

one or more file size values associated with one or more files of said target computer program; and

one or more checksum values associated with one or more files of said target computer program.

18. A method as claimed in claim 11, wherein said target computer program is a malware scanning computer program.

19. A method as claimed in claim 18, wherein said malware scanning computer program scans for one or more of:

computer viruses;

worms;

Trojans;

banned files;

banned words; and

banned images.

20. A method as claimed in claim 11, wherein said predetermined valid characteristics are store on said further computer.

21. Apparatus for validating an installation of a target computer program on a target computer, said apparatus comprising:

installation checking logic validated with a further computer connected by a network link to said target computer and operable to execute upon said target computer to gather characteristics of said installation of said target computer program upon said target computer;

comparing logic operable to comparing said gathered characteristics with predetermined valid characteristics;

response logic operable if said gathered characteristics match said predetermined valid characteristics to trigger an installation valid response and operable if said gathered characteristics do not match said predetermined valid characteristics to trigger an installation invalid response.

22. Apparatus as claimed in claim 21, wherein said installation checking logic is validated by being securely stored on said further computer and transferred from said further computer to said target computer before being executed on said target computer.

23. Apparatus as claimed in claim 21, wherein said installation checking logic is stored on said target computer and is validated by sending a secure key to said further computer.

24. Apparatus as claimed in claim 21, wherein validation of said installation is triggered by a user input.

25. Apparatus as claimed in claim 21, wherein validation of said installation is triggered when said target computer connects to a network.

26. Apparatus as claimed in claim 25, wherein a login script for said target computer starts execution of said installation checking computer program.

27. Apparatus as claimed in claim 21, wherein said characteristics of said installation include one or more of:

operating system registry entries for said target computer program;

a list of files stored in a program file directory of said target computer program;

one or more file size values associated with one or more files of said target computer program; and

one or more checksum values associated with one or more files of said target computer program.

28. Apparatus as claimed in claim 21, wherein said target computer program is a malware scanning computer program.

29. Apparatus as claimed in claim 28, wherein said malware scanning computer program scans for one or more of:

computer viruses;

worms;

Trojans;

banned files;

banned words; and

banned images.

30. Apparatus as claimed in claim 21, wherein said predetermined valid characteristics are store on said further computer.