Abstract:
A system and method for identifying and removing potentially unwanted software. A mechanism is provided that identifies suspect programs to a user and allows the user to prevent the suspect programs from running without actually deleting them. In one embodiment, scanner data identifying potentially unwanted software is displayed in a GUI that allows the user to inhibit its continued execution. For example, any software not on a list of known, benign applications/processes may be identified as potentially unwanted. Similarly, software that displays one or more suspect behaviors may be so identified, allowing the user to distinguish between normal and suspect software without irreversibly altering the user&#39;s system.

Description:
FIELD OF THE INVENTION  
       [0001]     The embodiment of the present invention relates unwanted software, and more particularly, to a system and method for identifying and removing potentially unwanted software.  
       BACKGROUND OF THE INVENTION  
       [0002]     It is estimated that four out of five users have unwanted software on their PCs. Many vendors have developed programs to remove these pieces of software. Typically, a collection of signatures is developed which represents each piece of unwanted software and the computer is searched for objects which match these signatures. The list of unwanted software is displayed to the user, and the user is given the option to remove and/or quarantine these objects. The problem with this approach is the need to develop an exact match for each piece of unwanted software which should be removed. This list of potentially unwanted software can grow indefinitely and needs constant updating. Moreover, at any given time there may be any number of entities developing and distributing potentially unwanted software, and it is difficult to install identifying signatures for each of them on every machine.  
         [0003]     The embodiment of the present invention is directed to providing a system and method that overcome the foregoing and other disadvantages. More specifically, the present invention is directed to a system and method for identifying and removing unwanted software.  
       SUMMARY OF THE INVENTION  
       [0004]     A system and method for identifying and removing unwanted software is provided. In accordance with one aspect of the invention, scanner data is promoted into a GUI for general application management to identify which specific software is potentially unwanted. When a specially formatted list of such software is presented visually and graphically to the user, the user can choose to stop these programs from running. The programs need not be deleted from the machine, but can instead be inhibited from running automatically, thus reducing their affect on the computer system.  
         [0005]     In accordance with another aspect of the invention, metrics and heuristics are provided for how software is to be highlighted as potentially unwanted or generally suspicious. In one embodiment, an expansive “known list” of known applications and processes is provided, and anything which does not match this list is highlighted as potentially unwanted. This technique does not suffer from the infinite “list of potentially unwanted software” arms race because as new variants of potentially unwanted software are invented, they are highlighted as being potentially unwanted and are displayed for removal or for being disabled.  
         [0006]     In accordance with another aspect of the invention, a list of characteristics is provided which identify potentially unwanted software. Running applications are monitored to see if they fall under these characteristics. For example, software which uses up protracted amounts of CPU time may be highlighted for the user in a list of potentially unwanted software.  
         [0007]     In accordance with another aspect of the invention, when potentially unwanted software is removed from a user&#39;s system, the user is provided with the ability to restore the software. A simple UI is provided which gives the user enough data to make an informed trust decision.  
         [0008]     In accordance with another aspect of the invention, a critical console view is provided to show the highest priority issues for identifying potentially unwanted software. The user may be provided with options for changing the priorities, and when the priorities are changed, a position or indicating mechanism may be adjusted (e.g., flopped) so as to show the new order of priorities. For example, when the first priority is reduced to a second priority, it may be shown that a new first priority has now been established as being in the first priority space. Unlike a traditional user interface which may strive to show menus in the same place, etc., the placement and UI/UX elements may be more associated with an organized/prioritized by severity, and not consistency of which column or tab stop shows what value (where a user would then have to look at the value and manually assess the relevance or severity). For example, memory, CPU, network CPU utilization, etc., may move around based on their current severity and be organized by priority, rather than data type. Even within the severity, the first priority item may be simply presented, or bolded/glowing if becoming even more risky, or flashing, beeping, etc., as increasing risk warrants. In other words, different levels of alarm can be shown depending on the current level of severity. Lower priorities (e.g., the fourth, fifth, or sixth priorities) may not be shown so as to avoid cluttering the view/thinking of the user, which might put the user more at risk if they were required to try to optimize the lower priorities (and thereby might ignore the more impending key risks). For example, CPU utilization might not be shown if relative to other things it is currently a less critical issue. All of these factors may be placed at the control of the user.  
         [0009]     It will be appreciated that the embodiment of the present invention is advantageous in that it makes a user&#39;s system less opaque so that they can easily tell when the system has unwanted programs attached to system extensibility points. By putting the user in the loop and informing the user of what is “normal” for their PC and what is “not normal,” the embodiment of the present invention empowers the user to understand what software is not expected and can be safely disabled. Instead of the user having to prove that a running process is not important and can be safely removed, the embodiment of the present invention asks the user to prove that an unidentified application is important, or else the default behavior is to disable the application in question. This approach thus places a natural check and balance on the almost unlimited extensibility of the computer.  
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0010]     The foregoing aspects and many of the attendant advantages of this invention will become more readily appreciated as the same become better understood by reference to the following detailed description, when taken in conjunction with the accompanying drawings, wherein:  
         [0011]      FIG. 1  is a flow diagram illustrative of a general routine for identifying potentially unwanted software in a computer system;  
         [0012]      FIG. 2  is a flow diagram illustrative of a routine for creating a list of known applications;  
         [0013]      FIG. 3  is a flow diagram illustrative of a routine for creating a list of characteristics for identifying potentially unwanted software;  
         [0014]      FIG. 4  is a flow diagram illustrative of a routine for providing a user with options for managing potentially unwanted software;  
         [0015]      FIG. 5A  is a flow diagram illustrative of a routine for monitoring software for intrusive or suspicious characteristics;  
         [0016]      FIG. 5B  is a flow diagram illustrative of a routine for a critical console view;  
         [0017]      FIG. 6  is a flow diagram illustrative of a routine of a first example embodiment for periodic spyware cleaning;  
         [0018]      FIG. 7  is a flow diagram illustrative of a routine of a second example embodiment for periodic spyware cleaning;  
         [0019]      FIG. 8  is a flow diagram illustrative of a routine of a third example embodiment for periodic spyware cleaning;  
         [0020]      FIG. 9  is a diagram of a screen shot illustrating a user interface for a user to manage potentially unwanted software;  
         [0021]      FIG. 10  is a diagram of the screen shot of  FIG. 9  in which additional options have been selected;  
         [0022]      FIG. 11  is a diagram of a screen shot illustrating a suspicious software view. 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT  
       [0023]      FIG. 1  is a flow diagram illustrative of a general routine  100  for identifying and inhibiting potentially unwanted software. At a block  110 , the computer is scanned for potentially unwanted software. At a block  120 , a list of potentially unwanted software is presented to the user. In one embodiment, scanner data is promoted into a GUI for general application management with regard to which software is “potentially unwanted.” At a block  130 , the user can choose to stop the potentially unwanted software from running. The programs need not be deleted from the machine, but instead can be inhibited from running automatically, thus reducing their effect on the computer system.  
         [0024]      FIG. 2  is a flow diagram illustrative of a routine  200  for highlighting selected software as potentially unwanted. There are many potential metrics and heuristics for how software can be highlighted as potentially unwanted or generally suspicious. As shown in  FIG. 2 , in one embodiment at a block  210 , a list of known applications and processes is created. At a block  220 , any software not matching the known list, as well as being on any type of bad list, is highlighted as potentially unwanted. It will be appreciated that this technique does not suffer from the infinite black list arms race because as new variants of spyware are invented, they will be highlighted as potentially unwanted and displayed for removal or being disabled.  
         [0025]      FIG. 3  is a flow diagram illustrative of a routine  300  for monitoring software for being potentially unwanted. At a block  310 , a list of characteristics for potentially unwanted software is created. At a block  320 , running applications are monitored to see if they fall under the list of empirical characteristic patterns. For example, software which uses protracted amounts of CPU time may be highlighted for the user in a list of potentially unwanted software.  
         [0026]      FIG. 4  is a flow diagram illustrative of a routine  400  for providing a user with options for managing potentially unwanted software. At a block  410 , when potentially unwanted software is quarantined from the system on the user&#39;s behalf, the user is informed and the ability is provided for the user to restore the software. At a block  420 , the user interface provides the user with data for making informed trust decisions on blocking, allowing, or always prompting before executing the software.  
         [0027]      FIG. 5A  is a flow diagram illustrative of a routine  500 A for providing a highlighted list of suspicious software. At a block  510 , software is monitored for intrusive or suspicious characteristics. At a block  520 , a highlighted list is provided of the applications which are determined to be the most intrusive or suspicious to the computer&#39;s operation in a suspicious software view. In one embodiment, the intrusive or suspicious characteristics may be prioritized, as will be described in more detail below with respect to  FIG. 5B .  
         [0028]      FIG. 5B  is a flow diagram illustrative of a routine  500 B for a critical console view. At a block  550 , the highest priority issue(s) for identifying potentially unwanted software are shown. Under this type of system, many factors may be monitored, but only the top concerns may be shown that are the most critical if they are left unchecked and continue to increase in rate. As an example, in one embodiment, the first, second and third priorities may be shown.  
         [0029]     At a block  560 , the user is provided with options for changing the priorities for determining the most intrusive or suspicious software. When the priorities are changed, a position or indicating mechanism may be adjusted (e.g., flopped) so as to illustrate the new order of priorities. For example, when the former first priority has been reduced to a second priority, it may be shown that a new first priority has now been established as being in the first priority space.  
         [0030]     At a block  570 , the placement and UI/UX elements are associated with and organized/prioritized by severity, rather than consistency of which column or tab stop shows what value (where the user would then have to look at the value and manually assess the relevance or severity). For example, memory, CPU, network CPU utilization, etc., may move around based on their current severity, and be organized by priority, not by data type. It will be appreciated that this is unlike a traditional UI which might strive to show menus in the same place.  
         [0031]     At a block  580 , an indication is provided for current level of severity. For example, the first priority item may be simply presented, or bolded/glowing if becoming even more risky, or flashing, or beeping, etc., as increasing risk warrants. In other words, different levels of alarm can be indicated, depending on the current level of severity.  
         [0032]     At a block  590 , lower priorities (e.g., the fourth, fifth or sixth priorities) may not be shown so as to avoid distracting the user with less critical issues. In other words, it may be desirable to avoid cluttering the view/thinking and thereby putting the user more at risk if the user is required to try to deal with the lower priority issues, which may end up distracting the user from the more impending key risks. For example, CPU utilization may not be shown if it is currently less important than other issues. All of these factors may be placed at the control of the user.  
         [0033]      FIGS. 6-8  provide examples of potential embodiments of periodic spyware cleaning, in accordance with the present invention.  FIG. 6  is a flow diagram illustrative of a routine  600  of a first example embodiment of periodic spyware cleaning. At a block  610 , a user has periodic spyware cleaning enabled. At a block  620 , troubleshooting is performed by opening a software explorer to view all of the software running on the PC and information regarding the software. Using the software explorer, it can easily be determined what software runs on start up, what software is currently running, extensions, including BHOs, etc. At a block  630 , the unwanted software is selected to be inhibited or removed. For example, a link may be clicked on to update the signatures manually, and a suspicious program may be identified as unauthorized advertising, at which point the program is removed and related pop-up ads cease to appear.  
         [0034]      FIG. 7  is a flow diagram illustrative of a routine  700  showing a second example embodiment of periodic spyware cleaning. At a block  710 , the user has periodic spyware cleaning enabled. At a block  720 , the user&#39;s PC has been running fine, but he is curious to see what software has been removed or blocked on his behalf. The user selects a “suspicious software” link which displays all of the spyware that has been detected on the machine and the status of each spyware which indicates whether it has been removed, disabled, enabled, etc.  
         [0035]      FIG. 8  is a flow diagram illustrative of a routine  800  of a third example embodiment of periodic spyware cleaning. At a block  810 , a user has periodic spyware cleaning enabled. At a block  820 , the user installs a new application on the user&#39;s PC. For example, the user may install a freeware application that computes time zones. At a block  830 , new spyware signatures are downloaded and a scan is run. It will be appreciated that the downloading of the new spyware signatures may occur at any time (e.g., after a week). At a block  840 , the application (e.g., the freeware time zone application) is identified as unauthorized advertising and the software is disabled from the PC, but the shortcut (e.g., LNK) is left in the quick launch and start menu. At a block  850 , the next time the user clicks on the LNK to launch the application, the user is provided with a message telling them that the software has been identified as potential spyware and has been disabled to protect the computer.  
         [0036]      FIG. 9  is a diagram of a screen shot  900  illustrating a user interface for managing potentially unwanted software. At a screen area  910 , an indication is provided that this is a “security warning.” At a screen area  920 , the user is informed “This has been identified as potentially unwanted software. Do you still want to run this?” At a screen area  930 , the user is provided with the name of the potentially unwanted software, as well as the behavior, which, in this case, is “unauthorized advertising.” At a screen area  940 , a user is provided with a selection for “more options.” At a screen area  950 , the user is provided with the options for running or not running the potentially unwanted software. At a screen area  960 , the user is provided with an indication that “To protect your computer, this software has been blocked from running. For more information on this software, click here.” 
         [0037]      FIG. 10  is a diagram of a screen shot  1000  in which the user interface of  FIG. 9  has had the “more options” selection made from the screen area  940 . As shown in  FIG. 10 , in a screen area  1040 , a user is provided with a “fewer options” selection. In a screen area  1045 , a user is provided with options for “always ask me”; “never run this software”; or “always run this software.” Through these options, a user is able to review and manage potentially unwanted software.  
         [0038]      FIG. 11  is a diagram of a screen shot  1100  of a suspicious software view. At a screen area  1110 , indications are provided for “software explorer” and “suspicious software.” At a screen area  1120 , a search option is provided for a user to “type to search.” At a screen area  1130 , options are provided for “file,” “allow,” “remove,” “quarantine,” “submit report,” and “run scan now.” At a screen area  1140 , options are provided for “installed programs,” “new programs,” “component,” and “suspicious software.” 
         [0039]     At a screen area  1150 , a name column is provided, which includes applications 1-12. At a screen area  1160 , a publisher column is provided, which includes the names of the publishers of the various applications, which in this case is Contoso Corp. for all of the applications. At a screen area  1170 , a status column is provided, which shows a status of “quarantined” for the applications 2 and 3. At a screen area  1180 , a recommendation column is provided, which shows recommendations of “remove” for applications 1-3, “quarantine” for applications 4-10, and “ignore” for applications 11-12.  
         [0040]     It will be appreciated that the embodiment of the present invention has a number of advantages. By putting the user in the loop and informing the user what is “normal” for their PC and what is “not normal,” the embodiment of the present invention empowers the user to understand what software is not expected and can be safely disabled. Instead of the user having to prove that a running process is not important and can be safely removed, the embodiment of the present invention asks the user to prove that an unidentified application is important, otherwise the default behavior of the system is to disable the application in question. This approach places a natural “check and balance” on the almost unlimited extensibility of the computer.  
         [0041]     While the preferred embodiment of the invention has been illustrated and described, it will be appreciated that various changes can be made therein without departing from the spirit and scope of the invention.