System and method for monitoring events on a computer to reduce false positive indication of pestware

• US 7,996,898 B2
• Filed: 10/25/2005
• Issued: 08/09/2011
• Est. Priority Date: 10/25/2005
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Greene, Michael P., Mood, Sarah L., Stowers, Bradley D.
• Primary Examiner(s): Dinh; Minh
• Assistant Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US11/258,536
• Publication Number:
  US 20070094732A1
• Time in Patent Office: 2,114 Days
• Field of Search: 726/22, 726/26, 713165-167, 713151-152
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A system and method for reducing false positive indications of pestware on a protected computer is disclosed. In one variation, the method includes tracking activities of a user at the protected computer, monitoring events at the protected computer, identifying events that are potentially indicative of pestware, comparing at least one of the events with at least one of the activities of the user and initiating, in response to the comparing indicating the activities of the user are unconnected with the events, a user prompt that informs the user about the events to enable the user to make a decision relative to managing the events.

Claims

1. A method for managing pestware on a protected computer comprising:

tracking activities of a user at the protected computer;

monitoring events at the protected computer;

identifying monitored events that are potentially indicative of pestware;

comparing at least one of the identified monitored events with at least one of the activities of the user; and

initiating, in response to a comparing that indicates the activities of the user are unconnected with the identified monitored events, a user prompt, wherein the user prompt informs the user about at least one of the identified monitored events so as to enable the user to make a decision relative to managing the at least one of the identified monitored events.

2. The method of claim 1, wherein the activities include activities selected from the group consisting of selecting a new homepage, adding a new bookmark, and selecting a new search page.

3. The method of claim 1, wherein the tracking activities of a user at the protected computer includes tracking websites visited by the user.

4. The method of claim 1, wherein the tracking activities of a user at the protected computer includes tracking at least one user interface utilized by the user.

5. The method of claim 4, wherein the at least one user interface is an options window of a web browser.

6. The method of claim 4, wherein comparing at least one of the identified monitored events with the activities of the user includes determining whether the at least one user interface is being utilized when the at least one of the identified monitored events is detected.

7. The method of claim 3, wherein the at least one of the identified monitored events is a change to a setting of a browser, wherein the change to the setting includes a pointer to a particular website, and wherein comparing the at least one of the identified monitored events with at least one of the activities of the user includes determining whether the particular website is one of the tracked websites visited by the user.

8. The method of claim 1, wherein the identified monitored events include events selected from the group consisting of a change in a homepage;

an addition of a new bookmark; and

a change in a search page.

9. A method for reducing false-positive indications of pestware comprising:

monitoring an application of a protected computer;

identifying a change in an application setting, wherein the application setting is utilized by the application;

determining whether the change to the setting was initiated via a process unassociated with the user application; and

informing, in response to the change to the setting being initiated by the process unassociated with the user application, a user of the protected computer about the changed setting.

10. The method of claim 9, wherein the application is a web browser and wherein the application setting is selected from the group consisting of a homepage setting, a bookmark setting, and a search page setting.

11. A non-transitory computer readable medium encoded with processor-executable instructions for managing pestware on a protected computer, the instructions comprising:

tracking activities of a user at the protected computer;

monitoring events at the protected computer;

identifying monitored events that are potentially indicative of pestware;

comparing at least one of the identified monitored events with at least one of the activities of the user; and

initiating, in response to a comparing that indicates the activities of the user are unconnected with the identified monitored events, a user prompt, wherein the user prompt informs the user about at least one of the identified monitored events so as to enable the user to make a decision relative to managing the at least one of the identified monitored events.

12. The non-transitory computer readable medium of claim 11, wherein the activities include activities selected from the group consisting of selecting a new homepage, adding a new bookmark, and selecting a new search page.

13. The non-transitory computer readable medium of claim 11, wherein the instructions for tracking activities of a user at the protected computer include instructions for tracking websites visited by the user.

14. The non-transitory computer readable medium of claim 11, wherein the instructions for tracking activities of a user at the protected computer includes instructions for tracking at least one user interface utilized by the user.

15. The non-transitory computer readable medium of claim 14, wherein the at least one user interface is an options window of a web browser.

16. The non-transitory computer readable medium of claim 14, wherein the instructions for comparing at least one of the identified monitored events with the activities of the user includes instructions for determining whether the at least one user interface is being utilized when the at least one of the identified monitored events is detected.

17. The non-transitory computer readable medium of claim 13, wherein the at least one of the identified monitored events is a change to a setting of a browser, wherein the change to the setting includes a pointer to a particular website, and wherein the instructions for comparing the at least one of the identified monitored events with at least one of the activities of the user includes instructions for determining whether the particular website is one of the tracked websites visited by the user.

18. The non-transitory computer readable medium of claim 11, wherein the events include events selected from the group consisting of a change in a homepage;

an addition of a new bookmark; and

a change in a search page.