Threat-resistant installer
View Patent ↗An install control module allows installation of a software application onto a computer in presence of malicious code that is attempting to prevent installation. A metamorphic installation program is generated randomly to be substantially unique using metamorphic stealthing techniques. The program can be installed and is executed on the computer. Identifying information in the metamorphic installation program is substantially disguised from the malicious code so the program is substantially unrecognizable. The software application is installed onto the computer, and the metamorphic program protects the installation to allow the software application to be installed without substantial interference from the malicious code. In another embodiment, installation occurs by booting a preinstall environment on the computer without running a primary operating system. The software application is installed offline without the primary operating system running and before malicious code present on the computer is executed.
1. A computer program product having a computer-readable medium having computer program instructions recorded thereon for installation of a software application onto a computer in presence of malicious code that is attempting to prevent installation, the computer program instruction comprising instructions for:
generating a metamorphic installation program for protecting the installation of the software application onto the computer, wherein the metamorphic installation program is generated randomly to be substantially unique while still having substantially a same functionality as other unique instances of the metamorphic installation program;
executing the metamorphic installation program on the computer, wherein identifying information in the metamorphic installation program is substantially disguised from the malicious code so the metamorphic installation program is substantially unrecognizable to the malicious code; and
installing the software application onto the computer, wherein the metamorphic installation program protects the installation to allow the software application to be installed without substantial interference from the malicious code by preventing the malicious code from detecting the installation of the software application.
2. The computer program product of claim 1 , further comprising instructions for installing the metamorphic installation program onto the computer, wherein the metamorphic installation program comprises a protection module that is installed on the computer prior to installation of the software application, the protection module for protecting installation of the software application by a main installer.
3. The computer program product of claim 1 , wherein the metamorphic installation program is a metamorphic main installer that installs the software application onto the computer while protecting the software application installation.
4. The computer program product of claim 1 , wherein the metamorphic installation program is further configured to modify itself during the execution so the identifying information is no longer disguised.
5. The computer program product of claim 1 , wherein the software application is a computer security program.
6. The computer program product of claim 1 , wherein the disguised identifying information is undetectable using string matching techniques.
7. A method of installation of a software application onto a computer in presence of malicious code that is attempting to prevent installation, the method comprising:
generating a metamorphic installation program for protecting the installation of the software application onto the computer, wherein the metamorphic installation program is generated randomly to be substantially unique while still having substantially a same functionality as other unique instances of the metamorphic installation program;
executing the metamorphic installation program on the computer, wherein identifying information in the metamorphic installation program is substantially disguised from the malicious code so the metamorphic installation program is substantially unrecognizable to the malicious code; and
installing the software application onto the computer, wherein the metamorphic installation program protects the installation to allow the software application to be installed without substantial interference from the malicious code by preventing the malicious code from detecting the installation of the software application.
8. The method of claim 7 , further comprising installing the metamorphic installation program onto the computer, wherein the metamorphic installation program is a protection module that is first installed on the computer before installation of the software application begins, the protection module for protecting installation of the software application by a main installer, wherein the protection module further protects future software application installations from disruption by malicious code.
9. The method of claim 7 , wherein the metamorphic installation program is a metamorphic main installer that installs the software application onto the computer while protecting the software application installation.
10. The method of claim 7 , wherein metamorphic installation program modifies itself using a self-decrypter during the execution to decrypt itself into an undisguised metamorphic installation program with the identifying information being no longer disguised.
11. The method of claim 7 , wherein generating the metamorphic installation program further comprises downloading the metamorphic installation program from a server.
12. The method of claim 7 , wherein generating the metamorphic installation program further comprises generating the metamorphic installation program on a substantially clean computer from a computer-readable medium.
13. A system for installation of a software application onto a computer in presence of malicious code that is attempting to prevent installation, the system comprising:
a generation module for generating a metamorphic installation program for protecting the installation of the software application onto the computer, wherein the metamorphic installation program is generated randomly to be substantially unique while still having substantially a same functionality as other unique instances of the metamorphic installation program;
an execution module for executing the metamorphic installation program on the computer, wherein identifying information in the metamorphic installation program is substantially disguised from the malicious code so the metamorphic installation program is substantially unrecognizable to the malicious code; and
a software installation module for installing the software application onto the computer, wherein the metamorphic installation program protects the installation to allow the software application to be installed without substantial interference from the malicious code by preventing the malicious code from detecting the installation of the software application.
14. The system of claim 13 , further comprising a metamorphic program installation module for installing the metamorphic installation program onto the computer, wherein the metamorphic installation program is a protection module that is first installed on the computer before or during installation of the software application, the protection module for protecting installation of the software application by a main installer.
15. The system of claim 13 , wherein the metamorphic installation program is a metamorphic main installer adapted for installing the software application onto the computer.
16. The system of claim 13 , wherein metamorphic installation program is adapted to modify itself during the execution so the identifying information is no longer disguised and is adapted to decrypt parts of the metamorphic installation program in real-time right before those parts are executed and before detection by the malicious code that the program is installing the software application.
17. The system of claim 13 , wherein the generation module is adapted to download the metamorphic installation program from a server.
18. The system of claim 13 , wherein the generation module is further adapted to generate the metamorphic installation program on a substantially clean computer from a computer-readable medium.
19. A system for installation of a software application onto a computer in presence of malicious code that is attempting to prevent installation, the system comprising an install control module configured for:
generating a metamorphic installation program for protecting the installation of the software application onto the computer, wherein the metamorphic installation program is generated randomly to be substantially unique while still having substantially a same functionality as other unique instances of the metamorphic installation program;
executing the metamorphic installation program on the computer, wherein identifying information in the metamorphic installation program is substantially disguised from the malicious code so the metamorphic installation program is substantially unrecognizable to the malicious code; and
installing the software application onto the computer, wherein the metamorphic installation program protects the installation to allow the software application to be installed without substantial interference from the malicious code by preventing the malicious code from detecting the installation of the software application.
20. The system of claim 19 , wherein the install control module is further configured for installing the metamorphic installation program onto the computer, wherein the metamorphic installation program is a protection module for protecting installation of the software application by a main installer.