IP Library Granted Patent US 8,250,652
Granted Patent B1
US 8,250,652 · App. 12/391,696 · Granted Aug 21, 2012

Systems and methods for circumventing malicious attempts to block the installation of security software

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,250,652
App. No.
12/391,696
Granted
Aug 21, 2012
Kind
B1
Abstract

Computer-implemented methods and systems for circumventing malicious attempts to block the installation of security-software programs are disclosed. An exemplary method for performing such a task may comprise: 1) detecting, during installation of a security-software program, an error that is indicative of an attack on the security-software program, 2) identifying at least one executable file targeted by the attack on the security-software program, 3) circumventing the attack by dynamically obfuscating the executable file targeted by the attack, and then 4) completing installation of the security-software program.

Claims (60)

1. A computer-implemented method for circumventing malicious attempts to block the installation of security software, the method comprising:

detecting, during installation of a security-software program, an error that is indicative of an attack on the security-software program;

identifying at least one executable file targeted by the attack on the security-software program;

in response to detecting the error that is indicative of the attack, circumventing the attack by dynamically obfuscating the executable file targeted by the attack by:

creating a symbolic link to the executable file;

dynamically obfuscating at least one reference point associated with the executable file;

completing installation of the security-software program;

wherein the method is performed by a computing device comprising at least one processor.

2. The method of claim 1 , wherein dynamically obfuscating the executable file targeted by the attack further comprises at least one of:

dynamically renaming the executable file;

dynamically modifying an install path for the executable file;

copying the executable file;

dynamically modifying at least one property of the executable file.

3. The method of claim 2 , wherein dynamically modifying the property of the executable file comprises at least one of:

removing version information from the executable file;

removing a digital certificate from the executable file.

4. The method of claim 1 , wherein the reference point associated with the executable file comprises at least one of:

registry keys associated with the executable file;

operating-system configuration files associated with the executable file;

proprietary settings associated with the executable file;

service-registration files associated with the executable file.

5. The method of claim 1 , further comprising:

detecting a security threat that is the source of the attack;

neutralizing the security threat.

6. The method of claim 5 , further comprising, upon neutralizing the security threat, restoring the executable file to its original state.

7. The method of claim 6 , further comprising restoring the reference point associated with the executable file to its original state.

8. The method of claim 1 , wherein the executable file comprises a service-registration file.

9. The method of claim 8 , wherein dynamically obfuscating the executable file comprises removing an operating-system service name referenced by the service-registration file.

10. A system for circumventing malicious attempts to block the installation of security-software programs, the system comprising:

a threat-detection module programmed to:

detect, during installation of a security-software program, an error that is indicative of an attack on the security-software program;

identify at least one executable file targeted by the attack on the security-software program;

a security module programmed to:

in response to detecting the error that is indicative of the attack, circumvent the attack by dynamically obfuscating the executable file targeted by the attack by:

creating a symbolic link to the executable file;

dynamically obfuscating at least one reference point associated with the executable file;

complete installation of the security-software program;

at least one processor configured to execute the threat-detection module and the security module.

11. The system of claim 10 , wherein the security module further dynamically obfuscates the executable file targeted by the attack by at least one of:

dynamically renaming the executable file;

dynamically modifying an install path for the executable file;

copying the executable file;

dynamically modifying at least one property of the executable file.

12. The system of claim 11 , wherein the security module dynamically modifies the property of the executable file by at least one of:

removing version information from the executable file;

removing a digital certificate from the executable file.

13. The system of claim 10 , wherein the security module is further programmed to:

detect a security threat that is the source of the attack;

neutralize the security threat.

14. The system of claim 13 , wherein the security module is further programmed to, upon neutralizing the security threat, restore the executable file to its original state.

15. The system of claim 14 , wherein the security module is further programmed to restore the reference point associated with the executable file to its original state.

16. The system of claim 10 , wherein the executable file comprises a service-registration file.

17. The system of claim 16 , wherein the security module dynamically obfuscates the executable file by removing an operating-system service name referenced by the service-registration file.

18. A non-transitory computer-readable medium comprising computer-executable instructions that, when executed by a processor of a computing device, cause the computing device to:

detect, during installation of a security-software program, an error that is indicative of an attack on the security-software program;

identify at least one executable file targeted by the attack on the security-software program;

in response to detecting the error that is indicative of the attack, circumvent the attack by dynamically obfuscating the executable file targeted by the attack by:

creating a symbolic link to the executable file;

dynamically obfuscating at least one reference point associated with the executable file;

complete installation of the security-software program.

Assignments (6)
CHANGE OF NAME Recorded Feb 6, 2023
From: NORTONLIFELOCK INC.
To: GEN DIGITAL INC.
Reel/Frame 062714/0605 →
NOTICE OF SUCCESSION OF AGENCY (REEL 050926 / FRAME 0560) Recorded Sep 13, 2022
From: JPMORGAN CHASE BANK, N.A.
To: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Reel/Frame 061422/0371 →
SECURITY AGREEMENT Recorded Sep 13, 2022
From: NORTONLIFELOCK INC.
To: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Reel/Frame 062220/0001 →
CHANGE OF NAME Recorded Feb 14, 2020
From: SYMANTEC CORPORATION
To: NORTONLIFELOCK INC.
Reel/Frame 051935/0228 →
SECURITY AGREEMENT Recorded Nov 4, 2019
From: SYMANTEC CORPORATION; BLUE COAT LLC; LIFELOCK, INC,; SYMANTEC OPERATING CORPORATION
To: JPMORGAN, N.A.
Reel/Frame 050926/0560 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Feb 24, 2009
From: POWELL, BRIAN; COOLEY, SHAUN
To: SYMANTEC CORPORATION
Reel/Frame 022303/0575 →