System and method of detecting unwanted software

A system for detecting one or more unwanted applications installed on a computing device, comprising:

• at least one processor configured to:
• detect a first file associated with a first application installed on the computing device;
• identify a second file being related to the first file based at least upon selected conditions;
• identify a second application installed on the computing device using at least one of the first and second files;
• determine a first frequency of use for the first application and a second frequency of use for the second application, wherein frequency of use comprises one or more of frequency of use of the application, frequency of launching the application until performing a virus scan of the application, frequency of calling of API functions of the operating system by the application, frequency of modification of files until the virus scan, and frequency of actions carried out using interface elements of the application;
• determining that the second application was installed at substantially the same time as the first application based on a comparison of a first feature vector formed from the first frequency of use and a second feature vector formed from the second frequency of use;
• and
• determine that the first application is an unwanted application when the comparison of the first feature vector and the second feature vector results in a degree of similarity greater than a threshold value.

A non-transitory computer readable medium storing computer executable codes for causing at least one computer to:

• detect a first file associated with a first application installed on the at least one computer;
• identify a second file being related to the first file based at least upon selected conditions;
• identify a second application installed on the at least one computer using at least one of the first and second files;
• determine a first frequency of use for the first application and a second frequency of use for the second application, wherein frequency of use comprises one or more of frequency of use of the application, frequency of launching the application until performing a virus scan of the application, frequency of calling of API functions of the operating system by the application, frequency of modification of files until the virus scan, and frequency of actions carried out using interface elements of the application;
• determining that the second application was installed at substantially the same time as the first application based on a comparison of a first feature vector formed from the first frequency of use and a second feature vector formed from the second frequency of use;
• and
• determine that the first application is an unwanted application when the comparison of the first feature vector and the second feature vector results in a degree of similarity greater than a threshold value.