Identifying and removing potentially unwanted software

• US 7,685,149 B2
• Filed: 03/28/2005
• Issued: 03/23/2010
• Est. Priority Date: 03/28/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Seinfeld, Marc E., Loh, Alvin, Butcher, Angela K., Bryan, Paul J., Azad, Kalid M., Garms, Jason, Reasor, Sterling M.
• Primary Examiner(s): Vital; Pierre M
• Assistant Examiner(s): Nofal; Christopher P
• Application Number:
  US11/092,995
• Publication Number:
  US 20060218145A1
• Time in Patent Office: 1,821 Days
• Field of Search: 707/102
• US Class Current: 726/22
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A system and method for identifying and removing potentially unwanted software. A mechanism is provided that identifies suspect programs to a user and allows the user to prevent the suspect programs from running without actually deleting them. In one embodiment, scanner data identifying potentially unwanted software is displayed in a GUI that allows the user to inhibit its continued execution. For example, any software not on a list of known, benign applications/processes may be identified as potentially unwanted. Similarly, software that displays one or more suspect behaviors may be so identified, allowing the user to distinguish between normal and suspect software without irreversibly altering the user'"'"'s system.

Claims

1. A method for identifying and managing unwanted programs on a computer system, the method comprising:

automatically creating on a computer system a list of known user desired programs, wherein the known user desired programs are specified by a user, and include software applications previously installed and utilized by the user of the computer system;

identifying one or more potentially unwanted programs by monitoring each of the programs running on the computer system to determine whether each running program satisfies a set of empirical characteristic patterns, wherein at least one empirical characteristic pattern indicates a measure of protracted amounts of processor time for programs running on the computer system, wherein a running program that is not on the list of known user desired programs and that exhibits an increase in a rate of protracted processor time use is identified as a potentially unwanted program;

designating a current severity rating for each potentially unwanted program that is identified, wherein the current severity ratings indicate those potentially unwanted programs that are currently the most intrusive or most suspicious to the computer system'"'"'s operations, wherein the current severity ratings reflect a user'"'"'s prioritization of metrics that include the potentially unwanted programs'"'"' memory utilization, network utilization, and network processor utilization;

displaying a list of potentially unwanted programs in accordance with the current severity ratings and the user'"'"'s prioritization of metrics, wherein the list comprises a status of each potentially unwanted program and a recommended action for the user to take for each potentially unwanted program;

prompting the user to allow each potentially unwanted program to run or to be prohibited from running; and

automatically updating the list of potentially unwanted programs as a result of changes to the metrics, the prioritization of the metrics, and the status.

2. The method of claim 1, wherein the identified programs not on the list of known user desired programs are presented to a user via a user interface configured to identify and manage at least one program.

3. The method of claim 1, wherein the identified programs not on the list of known user desired programs are quarantined and an option to restore any identified program not on the list of known user desired programs is presented to a user.

4. The method of claim 1, wherein the identified programs not on the list of known user desired programs and options, including blocking, allowing, or requesting a prompt before executing programs not on the list of known user desired programs, are presented to a user.

5. The method of claim 1, wherein a list of characteristics is utilized to identify programs not on the list of known user desired programs.

6. The method of claim 5, wherein a ranked list of at least two programs not on the list of known user desired programs are presented to the user.

7. The method of claim 1, wherein a list of known undesired programs is used to identify programs not on the list of known user desired programs.

8. Computer-readable storage media comprising executable instructions that perform the steps of:

automatically creating on a computer system a list of known user desired programs, wherein the known user desired programs are specified by a user, and include software applications previously installed and utilized by the user of the computer system;

identifying one or more potentially unwanted programs by monitoring each of the programs running on the computer system to determine whether each running program satisfies a set of empirical characteristic patterns, wherein at least one empirical characteristic pattern indicates a measure of protracted amounts of processor time for programs running on the computer system, wherein a running program that is not on the list of known user desired programs and that exhibits an increase in a rate of protracted processor time use is identified as a potentially unwanted program;

designating a current severity rating for each potentially unwanted program that is identified, wherein the current severity ratings indicate those potentially unwanted programs that are currently the most intrusive or most suspicious to the computer system'"'"'s operations, wherein the current severity ratings reflect a user'"'"'s prioritization of metrics that include the potentially unwanted programs'"'"' memory utilization, network utilization, and network processor utilization;

displaying a list of potentially unwanted programs in accordance with the current severity ratings and the user'"'"'s prioritization of metrics, wherein the list comprises a status of each potentially unwanted program and a recommended action for the user to take for each potentially unwanted program;

prompting the user to allow each potentially unwanted program to run or to be prohibited from running; and

automatically updating the list of potentially unwanted programs as a result of changes to the metrics, the prioritization of the metrics, and the status.

9. The computer-readable storage media of claim 8, wherein a list of characteristics for unwanted programs is utilized for identifying unwanted programs.

10. The computer-readable storage media of claim 9, wherein a ranked list of at least some of the unwanted programs is displayed.

11. The computer-readable storage media of claim 10, wherein the ranked list is ranked based on selected behaviors.

12. The computer-readable storage media of claim 8, wherein unwanted programs are quarantined and an option to restore any program is displayed.

13. The computer-readable storage media of claim 8, wherein the options include blocking, allowing, or requesting a prompt before executing the related unwanted program.

14. A computer system comprising a memory and processor configured to perform the following:

automatically creating on a computer system a list of known user desired programs, wherein the known user desired programs are specified by a user, and include software applications previously installed and utilized by the user of the computer system;

identifying one or more potentially unwanted programs by monitoring each of the programs running on the computer system to determine whether each running program satisfies a set of empirical characteristic patterns, wherein at least one empirical characteristic pattern indicates a measure of protracted amounts of processor time for programs running on the computer system, wherein a running program that is not on the list of known user desired programs and that exhibits an increase in a rate of protracted processor time use is identified as a potentially unwanted program;

designating a current severity rating for each potentially unwanted program that is identified, wherein the current severity ratings indicate those potentially unwanted programs that are currently the most intrusive or most suspicious to the computer system'"'"'s operations, wherein the current severity ratings reflect a user'"'"'s prioritization of metrics that include the potentially unwanted programs'"'"' memory utilization, network utilization, and network processor utilization;

displaying a list of potentially unwanted programs in accordance with the current severity ratings and the user'"'"'s prioritization of metrics, wherein the list comprises a status of each potentially unwanted program and a recommended action for the user to take for each potentially unwanted program;

prompting the user to allow each potentially unwanted program to run or to be prohibited from running; and

automatically updating the list of potentially unwanted programs as a result of changes to the metrics, the prioritization of the metrics, and the status.

15. The computer system of claim 14, wherein when the displayed characteristics are changed, the change is indicated by an indicating mechanism.

16. The computer system of claim 14, wherein the level of severity is depicted on the display in an organized manner based on the level of severity of the blocked, potentially unwanted programs.

17. The computer system of claim 14, wherein different levels of alarm are indicated depending on current levels of severity.

18. The computer system of claim 14, wherein one or more characteristics are not shown.

19. The computer system of claim 16, wherein the organized manner is the placement of user interface elements on the display denotes the current level of severity.

20. The computer system of claim 19 wherein the organized manner is the application of a user attention getting indicator to the characteristics that identify blocked, potentially unwanted programs with high levels of severity.