Systems and methods for neutralizing unauthorized attempts to monitor user activity

• US 20070168285A1
• Filed: 01/18/2006
• Published: 07/19/2007
• Est. Priority Date: 01/18/2006
• Status: Abandoned Application

• Current Assignee: Webroot Software Incorporated (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Girtakovskis, Jurijs, Schneider, Jerome
• Application Number:
  US11/334,306
• Publication Number:
  US 20070168285A1
• Time in Patent Office: Days
• US Class Current: 705/50
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Systems and methods for neutralizing unauthorized attempts to monitor user activity are described. In one embodiment, a system includes a detection module configured to detect an attempt to receive a message that is related to a protected application program. The system also includes a neutralization module configured to set a hook to neutralize the attempt.

Claims

1. A computer-implemented method, comprising:

setting a hook to receive messages that are indicative of user activity; and

scrambling at least one of the messages to neutralize a malware that is attempting to monitor the user activity.

2. The computer-implemented method of claim 1, wherein the hook corresponds to a keyboard hook, and the messages are indicative of keyboard activity.

3. The computer-implemented method of claim 1, wherein the messages are related to a protected application program, and the setting the hook includes setting the hook with a scope that is specific to the protected application program.

4. The computer-implemented method of claim 1, wherein the setting the hook includes installing a first filter function in the hook'"'"'s chain of filter functions, and the scrambling the at least one of the messages is performed using the first filter function to produce a scrambled message.

5. The computer-implemented method of claim 4, wherein a second filter function is installed by the malware in the hook'"'"'s chain of filter functions, and the second filter function receives the scrambled message.

6. The computer-implemented method of claim 5, further comprising:

maintaining the first filter function prior to the second filter function in the hook'"'"'s chain of filter functions.

7. The computer-implemented method of claim 1, wherein the scrambling the at least one of the messages includes selectively scrambling the at least one of the messages based on determining that the at least one of the messages is indicative of a masked keyboard entry.

8. A computer-readable medium comprising executable instructions to:

intercept a message that would otherwise be received by a keylogger; and

process the message so that the keylogger is rendered substantially ineffective.

9. The computer-readable medium of claim 8, wherein the executable instructions to intercept the message include executable instructions to set a keyboard hook to intercept the message.

10. The computer-readable medium of claim 9, wherein the executable instructions to the set the keyboard hook include executable instructions to set the keyboard hook at a user level.

11. The computer-readable medium of claim 8, wherein the executable instructions to process the message include executable instructions to determine that the message is indicative of a masked keyboard entry.

12. The computer-readable medium of claim 8, wherein the executable instructions to process the message include executable instructions to modify the message to produce a modified message.

13. The computer-readable medium of claim 8, wherein the executable instructions to process the message include executable instructions to block the message from being received by the keylogger.

14. A system of managing malware, comprising:

a detection module configured to detect an attempt to receive a message that is related to a protected application program; and

a neutralization module configured to set a hook to neutralize the attempt.

15. The system of claim 14, wherein the message is indicative of keyboard activity, and the hook corresponds to a keyboard hook.

16. The system of claim 14, wherein the detection module is configured to:

identify a suspicious module that is related to the attempt; and

determine whether the suspicious module is allowed to receive the message.

17. The system of claim 16, wherein the neutralization module is configured to set the hook to intercept the message that would otherwise be received by the suspicious module.

18. The system of claim 17, further comprising:

a message processing module configured to process the message so that the suspicious module is rendered substantially ineffective.

19. The system of claim 18, wherein the message processing module is configured to process the message by modifying the message to produce a modified message.

20. The system of claim 18, wherein the message processing module is configured to process the message by blocking the message from being received by the suspicious module.