Abstract: The present disclosure relates to protecting computer systems from installation of rogue shared libraries when executable files are launched. An example method generally includes detecting that a downloaded file has been written to an insecure location on the computing device. A computing device determines that the downloaded file includes at least a first executable component and, upon determining that the downloaded file includes executable components, generates a copy of the executable component in a protected repository on the computing device. The computing device overwrites the contents of the executable component with at least instructions to launch the copy of the downloaded file from the protected repository.

Abstract: A window defined by an add-on program is displayed to a user of an application program in a computer system. The add-on program detects the display to the user of an application window created by the application program. In response to this detection, the add-on program displays an add-on window to the user. The add-on window may enable the user to initiate new functions in the computer system, and the add-on window may be a child window (which is defined by the add-on program) that is embedded in a parent window displayed by the application program.