Patent ID: 9679134
Date: 2017-06-13
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented method for detecting display-controlling malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a software program, which is controlling a display of a computing device by interacting with an operating system of the computing device, to determine a display mode in use by the software program by determining that the software program is displaying an application window in an active physical display device that is not a default physical display device for the computing device; detecting at least one control measure taken by the software program to prevent loss of control of the computing device display; determining, based on a nature of the control measure taken to prevent loss of control of the computing device display, whether at least one of: determining, based at least on the nature of the control measure taken to prevent loss of control of the computing device display, that the software program includes display-controlling malware; and performing a security action in response to determining that the software program includes the display-controlling malware.