System and method for reducing false positive indications of pestware

• US 20070094732A1
• Filed: 10/25/2005
• Published: 04/26/2007
• Est. Priority Date: 10/25/2005
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Inc. (Open Text Corporation)
• Inventors: Greene, Michael, Stowers, Bradley, Mood, Sarah
• Granted Patent: US 7,996,898 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A system and method for reducing false positive indications of pestware on a protected computer is disclosed. In one variation, the method includes tracking activities of a user at the protected computer, monitoring events at the protected computer, identifying events that are potentially indicative of pestware, comparing at least one of the events with at least one of the activities of the user and initiating, in response to the comparing indicating the activities of the user are unconnected with the events, a user prompt that informs the user about the events to enable the user to make a decision relative to managing the events.

Claims

1. A method for managing pestware on a protected computer comprising:

tracking activities of a user at the protected computer;

monitoring events at the protected computer;

identifying events that are potentially indicative of pestware;

comparing at least one of the events with at least one of the activities of the user; and

initiating, in response to the comparing indicating the activities of the user are unconnected with the events, a user prompt, wherein the user prompt informs the user about at least one of the events so as to enable the user to make a decision relative to managing the at least one of the events.

2. The method of claim 1, wherein the activities include activities selected from the group consisting of selecting a new homepage, adding a new bookmark and selecting a new search page.

3. The method of claim 1, wherein the tracking activities of a user at the protected computer includes tracking websites visited by the user.

4. The method of claim 1, wherein the tracking activities of a user at the protected computer includes tracking at least one of the user interfaces utilized by the user.

5. The method of claim 4, wherein the at least one of the user interfaces is an options window of a web browser.

6. The method of claim 4, wherein comparing at least one of the events with the activities of the user includes determining whether the at least one of the user interfaces is being utilized when the at least one of the events is detected.

7. The method of claim 3, wherein the at least one of the events is a change to a setting of a browser, wherein the change to the setting includes a pointer to a particular website, and wherein comparing the at least one of the events with the activities of the user includes determining whether the particular website is one of the tracked websites visited by the user.

8. The method of claim 1, wherein the events include events selected from the group consisting of a change in a homepage;

an addition of a new bookmark; and

change in the search page.

9. A method for reducing false-positive indications of pestware comprising:

monitoring an application of a protected computer;

identifying a change in an application setting, wherein the application setting is utilized by the application;

determining whether the change to the setting was initiated via a process unassociated with the user application; and

informing, in response to the change to the setting being initiated by the process unassociated with the user application, a user of the protected computer about the changed setting.

10. The method of claim 9, wherein the application is a web browser and wherein the application setting is selected from the group consisting of a homepage setting, a bookmark setting and a search page setting.

11. A computer readable medium encoded with processor-executable instructions for managing pestware on a protected computer, the instructions including instructions for:

tracking activities of a user at the protected computer;

monitoring events at the protected computer;

identifying events that are potentially indicative of pestware;

comparing at least one of the events with at least one of the activities of the user; and

initiating, in response to the comparing indicating the activities of the user are unconnected with the events, a user prompt, wherein the user prompt informs the user about at least one of the events so as to enable the user to make a decision relative to managing the at least one of the events.

12. The computer readable medium of claim 11, wherein the activities include activities selected from the group consisting of selecting a new homepage, adding a new bookmark and selecting a new search page.

13. The computer readable medium of claim 11, wherein the instructions for tracking activities of a user at the protected computer include instructions for tracking websites visited by the user.

14. The computer readable medium of claim 11, wherein the instructions for tracking activities of a user at the protected computer includes instructions for tracking at least one of the user interfaces utilized by the user.

15. The computer readable medium of claim 14, wherein the at least one of the user interfaces is an options window of a web browser.

16. The computer readable medium of claim 14, wherein the instructions for comparing at least one of the events with the activities of the user includes instructions for determining whether the at least one of the user interfaces is being utilized when the at least one of the events is detected.

17. The computer readable medium of claim 13, wherein the at least one of the events is a change to a setting of a browser, wherein the change to the setting includes a pointer to a particular website, and wherein the instructions for comparing the at least one of the events with the activities of the user includes instructions for determining whether the particular website is one of the tracked websites visited by the user.

18. The computer readable medium of claim 11, wherein the events include events selected from the group consisting of a change in a homepage;

an addition of a new bookmark; and

change in the search page.