Ao Kaspersky Lab

Kaspersky Lab, Zao

Alexander A Stroykov

Alexander V Amrilloev

Mikhail A Pavlyushchik

Alexander A Romanenko

Yuri G Slobodyanuk

Vyacheslav V Zakorzhevsky

Sergey V Dobrovolsky

Oleg A Yurzin

Alexey S Subbotin

Pavel V Korzh

Mikhail A Modin

Sergey A Vasilyev

Sergey A Zubrilin

Aspects of the present disclosure include systems and methods for detecting unwanted software. An exemplary method comprises identifying a first file associated with a first application and a second file installed on the computing device, wherein the first file is related to the second file, identifying a second application installed on the computing device that uses at least one of the first and second files, determining a first frequency of use for the first application and a second frequency of use for the second application, determining that the second application was installed at substantially the same time as the first application based on a comparison of the first frequency of use and the second frequency of use and determining that the first application is an unwanted application when the comparison of the first frequency and the second frequency results in a degree of similarity greater than a threshold value.

System and method of detecting unwanted software

Disclosed are system and method for detecting one or more unwanted applications in a computing device. One exemplary method comprises: obtaining information relating to a first application installed on the computing device; detecting a first file associated with the first application; identifying a second file being related to the first file based at least upon selected conditions; identifying a second application installed on the computing device using at least one of the first and second files; determining a frequency of use for each of the first and second applications; and determining whether the first application is an unwanted application based on the frequency of use for each of the first and second applications.

Disclosed are systems and methods for controlling execution of programs on a computer. An exemplary method includes detecting an unknown program installed on a computer; identifying undesirable actions performed by the unknown program on the computer, wherein the undesirable actions include at least one of: actions performed by the program without knowledge of a user, actions for accessing personal user data on the computer, and actions effecting user's working with other programs or operating system of the computer determining whether the unknown program is undesirable or not based on the identified undesirable actions of the program; when the unknown program is determined be undesirable, prompting the user to select whether to allow or prohibit execution of the undesirable program on the computer; and when the unknown program is determined not to be undesirable, allowing execution of the unknown program on the computer.

System and method of preventing execution of undesirable programs

Disclosed are systems and methods for controlling installation of programs on a computer. An exemplary system is configured to detect installation of an unknown program on a computer; suspend installation of the unknown program; execute the unknown program in a secure environment; detect undesirable actions of the unknown program, including: actions performed by the program without knowledge of a user, actions for accessing personal user data on the computer, and actions effecting user's working with other programs or operating system of the computer; determine whether the unknown program is undesirable or not based on the detected undesirable actions of the program; when the unknown program is determined be undesirable, prompt the user to select whether to allow or prohibit installation of the undesirable program on the computer; and when the unknown program is determined not to be undesirable, allow installation of the unknown program on the computer.

System and method of preventing installation and execution of undesirable programs

Aspect of the invention are directed to antivirus scanning, by a proxy server, of data downloaded from the network onto a PC workstation. The antivirus scanning is optimized for each scan by selecting an algorithm for that scan based on a determined overall likelihood that the downloaded data contains malicious code. Determination of the overall likelihood is augmented by the strength, or confidence, of statistical data relating to malware screening of results of previous downloads having similar parameters to the instant download.

Growing community of inventors

Moscow, Russia

Alexander A Stroykov