Patent ID: 8099784
Filing Date: 2012-01-17
Classification: G06F

Abstract:
1. A non-transitory computer-readable storage medium storing executable computer program instructions for malicious code detection based on uninstaller modification or removal, the computer program instructions comprising instructions for performing steps comprising: monitoring installation actions performed to install applications on a computer; detecting an installation action being performed to install an application on the computer, the installation action executing an installer that installs the application and installs an uninstaller for uninstalling the application; detecting an attempt to remove or modify the uninstaller to render the uninstaller incapable of uninstalling the application, the attempt to remove or modify the uninstaller indicating possible presence of malicious code; intercepting and blocking the attempt to remove or modify the uninstaller of the application; responsive to detecting an attempt to remove or modify the uninstaller, determining whether the application being installed on the computer comprises malicious code; and responsive to the determination that the application being installed on the computer comprises malicious code, utilizing the uninstaller for the application to uninstall the application.