System and Method of Opportunistically Protecting a Computer from Malware

Abstract

The present invention provides a system, method, and computer-readable medium that opportunistically install a software update on a computer that closes a vulnerability that existed on the computer. In accordance with one aspect of the present invention, when antivirus software on a computer identifies malware, a method causes a software update that closes the vulnerability exploited by the malware to be installed on the computer. The method includes identifying the vulnerability exploited by the malware, using a software update system to obtain a software update that is configured to close the vulnerability; and causing the software update to be installed on the computer where the vulnerability exists.

What is claimed: 
     
         1 . A method performed on a first computing device, the method comprising:
 receiving data comprising an identification of detected malware infecting a second computing device;   obtaining, in response to the receiving, a patch that corresponds to the detected malware and to a vulnerability exploited to infect the second computing device with the detected malware; and   sending the obtained patch to the second computing device.   
     
     
         2 . The method of  claim 1  where the received at a further comprises an identification of the vulnerability. 
     
     
         3 . The method of  claim 1  further comprising identifying, based on the received data, the vulnerability. 
     
     
         4 . The method of  claim 3  where the identifying comprises mapping the vulnerability to the detected malware. 
     
     
         5 . The method of  claim 1  where the patch is configured for closing the identified vulnerability on the second computing device. 
     
     
         6 . The method of  claim 1  where the obtaining the patch is from a service that is a trusted entity. 
     
     
         7 . The method of  claim 1  further comprising reporting, in response to the obtaining failing, a non-availability of the patch to a trusted entity. 
     
     
         8 . At least one computer-readable storage device storing computer-executable instructions that, when executed by a first computing device, cause the first computing device to perform actions comprising:
 receiving data comprising an identification of detected malware infecting a second computing device;   obtaining, in response to the receiving, a patch that corresponds to the detected malware and to a vulnerability exploited to infect the second computing device with the detected malware; and   sending the obtained patch to the second computing device.   
     
     
         9 . The at least one computer-readable storage device of  claim 8  where the received data further comprises an identification of the vulnerability. 
     
     
         10 . The at least one computer-readable storage device of  claim 8 , the actions further comprising identifying, based on the received data, the vulnerability. 
     
     
         11 . The at least one computer-readable storage device of  claim 10  where the identifying comprises mapping the vulnerability to the detected malware. 
     
     
         12 . The at least one computer-readable storage device of  claim 8  where the patch is configured for closing the identified vulnerability on the second computing device. 
     
     
         13 . The at least one computer-readable storage device of  claim 8  where the obtaining the patch is from a service that is a trusted entity. 
     
     
         14 . The at least one computer-readable storage device of  claim 8 , the actions further comprising reporting, in response to the obtaining failing, a non-availability of the patch to a trusted entity. 
     
     
         15 . A system comprising a first computing device and at least one program module together configured for performing actions comprising:
 receiving data comprising an identification of detected malware infecting a second computing device;   obtaining, in response to the receiving, a patch that corresponds to the detected malware and to a vulnerability exploited to infect the second computing device with the detected malware; and   sending the obtained patch to the second computing device.   
     
     
         16 . The method of  claim 15  where the received data further comprises an identification of the vulnerability. 
     
     
         17 . The method of  claim 15 , the actions further comprising identifying, based on the received data, the vulnerability. 
     
     
         18 . The method of  claim 17  where the identify comprises mapping the vulnerability to the detected malware. 
     
     
         19 . The method of  claim 15  where the obtaining the patch is from a service that is a trusted entity, or where the patch is configured for closing the identified vulnerability on the second computing device. 
     
     
         20 . The method of  claim 15 , the actions further comprising reporting, in response to the obtaining failing, a non-availability of the patch to a trusted entity.