Patent ID: 9111089
Filing Date: 2015-08-18
Classification: G06F

Abstract:
1. A computer-implemented method for safely executing programs, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying an attempt to launch an executable file; identifying a reputation associated with the executable file; determining, based on the reputation, that the executable file is not trusted without determining that the executable file is malicious based on a reputation score that indicates that the executable file may be malicious, wherein a favorable reputation score indicates that at least one of a file and a source of a file is generally trusted within a community and an unfavorable reputation score indicates that at least one of a file or source of a file is generally untrusted within a community; in response to determining that the executable file is not trusted without determining that the executable file is malicious, fulfilling the attempt by sandboxing a process instantiated from the executable file, wherein sandboxing the process instantiated from the executable file comprises imposing a filter on interactions between the process and a resource of the computing device by, when the process attempts to write to the resource, redirecting the write attempt to a virtual file; sandboxing the process across sessions by saving the virtual file after the process terminates for use when the executable file is subsequently executed and by: