Reducing false positives during behavior monitoring

A method of detecting malware in a computer system, said method comprising:

• executing a virus scan engine to perform a scan of files on said computer system;
• making a determination based upon said scan that no malware is present in said computer system;
• when the virus scan engine determines that no malware is present, monitoring behavior of the computer system to detect suspicious behavior;
• when suspicious behavior is detected, performing the following:
• identifying an application responsible for the suspicious behavior;
• determining, using an anti-malware program, whether said application is present on a centrally uninstallable software list of an operating system running on said computer system, wherein the centrally uninstallable software list is also utilized by the operating system independent of the anti-malware program, wherein the presence of said application on said centrally uninstallable software list indicates that said application has been previously installed on said computer system and is available to be uninstalled through a centralized operating system process;
• and
• permitting said application to perform said process when it is determined that said application is present on said centrally uninstallable software list.

A method of detecting malware in a computer system, said method comprising:

• receiving an indication of an application desiring to be installed in said computer system;
• installing said application in said computer system;
• placing an application identifier associated with said application on a centrally uninstallable software list using the operating system independent of an anti-malware program, wherein the centrally uninstallable software list indicates that said application has been installed in said computer system and is available to be uninstalled through a centralized operating system process;
• upon detecting suspicious behavior by a process of said computer system that is associated with said application:
• determining that said application identifier is present on said software list of said computer system;
• and
• permitting said application to perform said process when it is determined that said application identifier is present on said software list.

An apparatus comprising:

• a behavior monitoring engine comprising:
• a behavior capturing module configured to capture behavior of processes on a computer system;
• a rules database;
• and
• a state machine configured to compare captured behavior of processes on the computer system to rules contained in the rules database to determine that the behavior is suspicious;
• an uninstall software list comparison module configured to, upon the state machine determining that the behavior is suspicious, determine if an application associated with the processes is present on an uninstall software list for the computer system, wherein the uninstall software list is maintained and used by an operating system independent of the behavior monitoring engine;
• and
• a malware rejection module configured to permit the application to perform the processes when it is determined that the application is present on the uninstall software list for the computer system.