System and method for identifying and removing potentially unwanted software

• US 20060218145A1
• Filed: 03/28/2005
• Published: 09/28/2006
• Est. Priority Date: 03/28/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Garms, Jason, Reasor, Sterling M., Seinfeld, Marc E., Loh, Alvin, Butcher, Angela K., Bryan, Paul J., Azad, Kalid M.
• Granted Patent: US 7,685,149 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A system and method for identifying and removing potentially unwanted software. A mechanism is provided that identifies suspect programs to a user and allows the user to prevent the suspect programs from running without actually deleting them. In one embodiment, scanner data identifying potentially unwanted software is displayed in a GUI that allows the user to inhibit its continued execution. For example, any software not on a list of known, benign applications/processes may be identified as potentially unwanted. Similarly, software that displays one or more suspect behaviors may be so identified, allowing the user to distinguish between normal and suspect software without irreversibly altering the user'"'"'s system.

Claims

1. A method for identifying unwanted programs on a computer system, comprising:

creating a list of known desired programs; and

comparing the list to other programs and identifying one or more programs which are not on the list as being potentially unwanted.

2. The method of claim 1, wherein the potentially unwanted programs are presented in a list to a user.

3. The method of claim 2, wherein the user can choose to stop potentially unwanted programs from running.

4. The method of claim 1, wherein the potentially unwanted programs may be quarantined on a user'"'"'s behalf, and the user is provided with the ability to restore the programs.

5. The method of claim 1, wherein the potentially unwanted programs are presented to a user and the user can choose to block, allow, or request prompting before executing the potentially unwanted programs.

6. The method of claim 1, wherein a list of characteristics may also be utilized to identify potentially unwanted programs.

7. The method of claim 6, wherein a ranked list of at least some of the potentially unwanted programs is presented to the user.

8. The method of claim 1, wherein a list of known undesired programs is also utilized for identifying potentially unwanted programs.

9. One or more computer-readable media for enabling a computer-program segment to communicate with one or more other computer-program segments for identifying unwanted programs, said media comprising:

a set of computer-usable instructions that identify potentially unwanted programs and present one or more of the potentially unwanted programs to a user.

10. The media of claim 9, wherein unknown programs are checked against a list of known desired programs to determine if the programs are potentially unwanted.

11. The media of claim 9, wherein a list of characteristics for potentially unwanted programs is utilized for identifying potentially unwanted programs.

12. The media of claim 11, wherein a ranked list of at least some of the potentially unwanted programs is presented to a user.

13. The media of claim 12, wherein the list is ranked based on selected behaviors.

14. The media of claim 9, wherein potentially unwanted programs are quarantined on a user'"'"'s behalf and the user is informed and provided with the ability to restore the potentially unwanted programs.

15. The media of claim 9, wherein a user is able to choose whether to block, allow, or always prompt before running the potentially unwanted programs.

16. A system for identifying potentially unwanted programs, comprising:

a critical console view for showing one or more high priority issues for identifying potentially unwanted programs.

17. The system of claim 16, wherein the user may change the priorities, and when the priorities are changed, an indicating mechanism is adjusted to show the change in priorities.

18. The system of claim 16, wherein positions of elements in the critical console view are changed depending on current levels of severity.

19. The system of claim 16, wherein different levels of alarm may be indicated depending on current levels of severity.

20. The system of claim 16, wherein one or more lower priority items are not shown.