Installer detection and warning system and method

• US 20090100519A1
• Filed: 10/16/2007
• Published: 04/16/2009
• Est. Priority Date: 10/16/2007
• Status: Abandoned Application

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Tarbotton, Lee Codel Lawson, Hinchliffe, Alex James
• Application Number:
  US11/907,668
• Publication Number:
  US 20090100519A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A user of a computer system is provided with warning of unexpected or covert installation attempts using a malware or anti-virus detection engine. Even though the files that are unexpectedly attempted to be installed may be legitimate, rather than malware, the malware detection software is modified or configured to detect the unexpected installation and provide the user with an opportunity to abort the installation. A method of controlling installation of software in a computer system comprises detecting an attempt to install software on the computer system, identifying the software that was attempted to be installed, taking an action in response to identifying the software that was attempted to be installed.

Claims

1. A method of controlling installation of software in a computer system comprising:

detecting an attempt to install software on the computer system;

identifying the software that was attempted to be installed; and

taking an action in response to identifying the software that was attempted to be installed.

2. The method of claim 1, wherein the attempt to install software on the computer system is detected using malware detection software.

3. The method of claim 2, wherein the malware detection software is modified or configured to detect the attempt to install software on the computer system.

4. The method of claim 1, wherein the software that was attempted to be installed is identified by analyzing information relating to the attempted installation.

5. The method of claim 4, wherein the analyzed information comprises at least one of:

an installer package, a family of installer packages to which the installer package belongs, installer header data, links the installer package may make, data identifying the software that was attempted to be installed, and links the software that was attempted to be installed would make if it were installed.

6. The method of claim 1, wherein the action taken in response to identifying the software that was attempted to be installed comprises:

notifying a user of the computer system of the attempt to install software on the computer system; and

accepting from the user of the computer system input indicating further action to be taken.

7. The method of claim 6, wherein the further action to be taken comprises aborting the installation, allowing the installation, or allowing part of the installation and blocking part of the installation.

8. The method of claim 1, wherein the action taken in response to identifying the software that was attempted to be installed comprises taking at least one predefined action.

9. The method of claim 8, wherein the predefined action to be taken comprises aborting the installation, allowing the installation, or allowing part of the installation and blocking part of the installation.

12. The computer program product of claim 11, wherein the malware detection software is modified or configured to detect the attempt to install software on the computer system.

10. A computer program product for controlling installation of software in a computer system comprising:

a computer readable storage medium;

computer program instructions, recorded on the computer readable storage medium, executable by a processor, for performing the steps of

detecting an attempt to install software on the computer system;

identifying the software that was attempted to be installed; and

taking an action in response to identifying the software that was attempted to be installed.

11. The computer program product of claim 10, wherein the attempt to install software on the computer system is detected using malware detection software.

13. The computer program product of claim 10, wherein the software that was attempted to be installed is identified by analyzing information relating to the attempted installation.

14. The computer program product of claim 13, wherein the analyzed information comprises at least one of:

an installer package, a family of installer packages to which the installer package belongs, installer header data, links the installer package may make, data identifying the software that was attempted to be installed, and links the software that was attempted to be installed would make if it were installed.

15. The computer program product of claim 10, wherein the action taken in response to identifying the software that was attempted to be installed comprises:

notifying a user of the computer system of the attempt to install software on the computer system; and

accepting from the user of the computer system input indicating further action to be taken.

16. The computer program product of claim 15, wherein the further action to be taken comprises aborting the installation, allowing the installation, or allowing part of the installation and blocking part of the installation.

17. The computer program product of claim 10, wherein the action taken in response to identifying the software that was attempted to be installed comprises taking at least one predefined action.

18. The computer program product of claim 17, wherein the predefined action to be taken comprises aborting the installation, allowing the installation, or allowing part of the installation and blocking part of the installation.