Method and system for accurate detection and removal of pestware

• US 20070294767A1
• Filed: 06/20/2006
• Published: 12/20/2007
• Est. Priority Date: 06/20/2006
• Status: Abandoned Application

• Current Assignee: Webroot Software Incorporated (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Piccard, Paul, Green, Michael P.
• Application Number:
  US11/471,201
• Publication Number:
  US 20070294767A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files

Abstract

A method and system for accurate detection and removal of pestware is described. One embodiment identifies a first indicator, the first indicator being associated with both a particular type of pestware and with at least one non-pestware software application; searches the computer for at least one additional indicator that the particular type of pestware is present on the computer; and confirms detection of the particular type of pestware on the computer when the at least one additional indicator is found.

Claims

1. A method for detecting pestware on a computer, the method comprising:

identifying a first indicator on the computer, the first indicator being associated with both a particular type of pestware and with at least one non-pestware software application;

searching the computer for at least one additional indicator that the particular type of pestware is present on the computer; and

confirming detection of the particular type of pestware on the computer when the at least one additional indicator is found.

2. The method of claim 1, further comprising:

notifying a user that the particular type of pestware has been detected on the computer.

3. The method of claim 1, wherein the first indicator is associated with a component that is shared by the particular type of pestware and the at least one non-pestware software application.

4. The method of claim 1, further comprising:

removing from the computer components of the particular type of pestware associated with the first indicator and the at least one additional indicator when detection of the particular type of pestware has been confirmed.

5. The method of claim 4, wherein a component associated with the first indicator is not removed when the component associated with the first indicator is shared by the particular type of pestware and the at least one non-pestware application and a search of the computer has confirmed that the at least one non-pestware application is installed on the computer.

6. The method of claim 1, wherein the confirming includes assigning relative weighting factors to the first indicator and to each of the at least one additional indicator.

7. The method of claim 1, wherein an indicator is one of a registry entry, an installation directory, an executable file, a dynamic link library (DLL), and a software component.

8. A system for detecting pestware on a computer, the system comprising:

a scanning module configured to identify a first indicator on the computer, the first indicator being associated with a particular type of pestware, the first indicator being insufficient by itself to warrant a conclusion that the particular type of pestware is present on the computer; and

a confirmation module configured to;

search the computer for at least one additional indicator that the particular type of pestware is present on the computer when the scanning module has identified the first indicator; and

confirm detection of the particular type of pestware on the computer when the at least one additional indicator is found.

9. The system of claim 8, further comprising:

a notification module configured to notify a user that the particular type of pestware has been detected on the computer.

10. The system of claim 8, wherein the first indicator is associated with both the particular type of pestware and with at least one non-pestware software application.

11. The system of claim 10, wherein the first indicator is associated with a common component that is shared by the particular type of pestware and the at least one non-pestware software application.

12. The system of claim 8, further comprising:

a removal module configured to remove from the computer components of the particular type of pestware associated with the first indicator and the at least one additional indicator when the confirmation module has confirmed detection of the particular type of pestware.

13. The system of claim 12, wherein the removal module is configured not to remove a component associated with the first indicator when the component associated with the first indicator is shared by the particular type of pestware and at least one non-pestware application and the confirmation module has determined that the at least one non-pestware application is installed on the computer.

14. The system of claim 8, wherein the confirmation module is further configured to assign relative weighting factors to the first indicator and to each of the at least one additional indicator.

15. The system of claim 8, wherein an indicator is one of a registry entry, an installation directory, an executable file, a dynamic link library (DLL), and a software component.

16. A system for detecting pestware on a computer, the system comprising:

means for identifying a first indicator on the computer, the first indicator being associated with a particular type of pestware, the first indicator being insufficient by itself to warrant a conclusion that the particular type of pestware is present on the computer;

means for searching the computer for at least one additional indicator that the particular type of pestware is present on the computer; and

means for confirming detection of the particular type of pestware on the computer when the at least one additional indicator is found.

17. The system of claim 16, wherein the first indicator is associated with both the particular type of pestware and with at least one non-pestware software application.

18. The system of claim 16, further comprising:

means for notifying a user that the particular type of pestware has been detected on the computer.

19. The system of claim 16, further comprising:

means for removing from the computer components of the particular type of pestware associated with the first indicator and the at least one additional indicator when detection of the particular type of pestware has been confirmed.

20. The system of claim 19, wherein the means for removing is configured not to remove a component associated with the first indicator when the component associated with the first indicator is shared by the particular type of pestware and at least one non-pestware application and the means for confirming has determined that the at least one non-pestware application is installed on the computer.

21. A computer-readable storage medium having program instructions executable by a processor to detect pestware on a computer, the program instructions comprising:

a first code segment configured to identify a first indicator on the computer, the first indicator being associated with both a particular type of pestware and with at least one non-pestware software application;

a second code segment configured to search the computer for at least one additional indicator that the particular type of pestware is present on the computer; and

a third code segment configured to confirm detection of the particular type of pestware on the computer when the at least one additional indicator is found.