# US 10,482,250 B1 · Using a common account to block malware on multiple devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,250 B1 - Document ID: US10482250B1 - Status: Granted - Kind: B1 - Application number: 15/846,627 - Filed: 2017-12-19 - Granted: 2019-11-19 - Earliest claimed: 2017-12-19 - Assignees: Symantec Corporation - Applicants: Symantec Corporation - Inventors: Nikhil Nishikant Joshi; Sharad Subhash Mhaske - Web page: https://patentgrep.com/patent/US10482250B1 ## CPC - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/562: {Static detection} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for preventing malware is described. The method may include identifying a malicious application running on a first computing device, determining that the malicious application is installed on a second computing device based on the identifying, and performing a single operation including uninstalling the malicious application from the first computing device and the second computing device. ## Claims ### Claim 1 A method for preventing malware, the method being performed by one or more computing devices comprising at least one processor, the method comprising: identifying, by a first computing device, a malicious application running on the first computing device; determining, by the first computing device, that the identified malicious application is installed on a second computing device based at least in part on the identifying; generating a message indicating the identified malicious application and a selectable option to perform a security action comprising at least one of quarantining, blocking, or force stopping the identified malicious application; transmitting, to the second computing device, the message indicating the Identified malicious application and the selectable option to perform the security action based at least in part on the first computing device and the second computing device sharing a common account associated with a malware detection application or an enterprise application store; and performing, by the first computing device, a single operation comprising uninstalling the identified malicious application from the first computing device and the second computing device based at least in part on a global setting to enable removal of malicious applications from all connected devices, wherein uninstalling the identified malicious application from the second computing device is based at least in part on the message. ### Claim 2 (depends on 1) The method of claim 1, further comprising: enabling the single operation, based at least in part on a setting of the first computing device and the second computing device, to collectively uninstall the identified malicious application from both the first computing device and the second computing device. ### Claim 3 (depends on 1) The method of claim 1, further comprising: providing the message for display on the first computing device; receiving a response message based at least in part on the message; and performing the security action based at least in part on the response message, wherein uninstalling the identified malicious application from the first computing device is based at least in part on performing the security action. ### Claim 4 (depends on 3) The method of claim 3, wherein the selectable option to perform the security action comprises a selection to approve or disapprove the uninstall. ### Claim 5 (depends on 1) The method of claim 1, further comprising: performing a malware scan on one or more applications installed on the first computing device, wherein identifying the malicious application running on the first computing device is based at least in part on the malware scan. ### Claim 6 (depends on 1) The method of claim 1, wherein the first computing device and the second computing device share the common account associated with the malware detection application or an application distribution platform. ### Claim 7 (depends on 6) The method of claim 6, further comprising: identifying the second computing device based at least in part on the common account, wherein determining that the identified malicious application is installed on the second computing device is based at least in part on the common account. ### Claim 8 (depends on 6) The method of claim 6, wherein the common account comprises an application setting and an association to a database. ### Claim 9 (depends on 8) The method of claim 8, wherein the application setting comprises instructions to perform at least one of notifying each computing device associated with the common account of the identified malicious application or collectively instructing each computing device associated with the common account to automatically uninstall the identified malicious application, or both. ### Claim 10 (depends on 8) The method of claim 8, wherein the database comprises one or more entries comprising a unique identifier associated with each computing device, an association of each unique identifier to the common account or a trusted third-party account, and a list of applications installed on each computing device, or any combination thereof. ### Claim 11 A computing device configured for preventing malware, further comprising: one or more processors; memory in electronic communication with the one or more processors, wherein the memory stores computer executable instructions that when executed by the one or more processors cause the one or more processors to: identify, by the computing device, a malicious application running on the computing device; determine, by the computing device, that the identified malicious application is installed on a second computing device based at least in part on the identifying; generate a message indicating the identified malicious application and a selectable option to perform a security action comprising at least one of quarantining, blocking, or force stopping the identified malicious application; transmit, to the second computing device, the message indicating the identified malicious application and the selectable option to perform the security action based at least in part on the computing device and the second computing device sharing a common account associated with a malware detection application or an enterprise application store; and perform, by the computing device, a single operation comprising uninstalling the identified malicious application from the computing device and the second computing device based at least in part on a global setting to enable removal of malicious applications from all connected devices, wherein uninstalling the identified malicious application from the second computing device is based at least in part on the message. ### Claim 12 (depends on 11) The computing device of claim 11, wherein the instructions are further executable by the one or more processors to: enable the single operation, based at least in part on a setting of the computing device and the second computing device, to collectively uninstall the identified malicious application from both the computing device and the second computing device. ### Claim 13 (depends on 11) The computing device of claim 11, wherein the instructions are further executable by the one or more processors to: provide the message for display on the computing device; receive a response message based at least in part on the message; and perform the security action based at least in part on the response message, wherein uninstalling the identified malicious application from the computing device is based at least in part on performing the security action. ### Claim 14 (depends on 13) The computing device of claim 13, wherein the selectable option to perform the security action comprises a selection to approve or disapprove the uninstall. ### Claim 15 (depends on 11) The computing device of claim 11, wherein the instructions are further executable by the one or more processors to: perform a malware scan on one or more applications installed on the computing device, wherein identifying the malicious application running on the computing device is based at least in part on the malware scan. ### Claim 16 (depends on 11) The computing device of claim 11, wherein the computing device and the second computing device share the common account associated with the malware detection application or an application distribution platform. ### Claim 17 A non-transitory computer-readable medium storing computer executable instructions that when executed by the one or more processors cause the one or more processors to: identify, by the one or more processors of a first computing device, a malicious application running on the first computing device; determine, by the one or more processors of the first computing device, that the identified malicious application is installed on a second computing device based at least in part on the identifying; generate a message Indicating the Identified malicious application and a selectable option to perform a security action comprising at least one of quarantining, blocking, or force stopping the identified malicious application; transmit, to the second computing device, the message indicating the identified malicious application and the selectable option to perform the security action based at least in part on the first computing device and the second computing device sharing a common account associated with a malware detection application or an enterprise application store; and perform, by the one or more processors of the first computing device, a single operation comprising uninstalling the identified malicious application from the first computing device and the second computing device based at least in part on a global setting to enable removal of malicious applications from all connected devices, wherein uninstalling the identified malicious application from the second computing device is based at least In art on the message. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the instructions are further executable by the one or more processors to: enable the single operation, based at least in part on a setting of the first computing device and the second computing device, to collectively uninstall the identified malicious application from both the first computing device and the second computing device.