A method for limiting the operation of trusted applications in the presence of suspicious programs, the method executed by a hardware processor (110, 120) comprising: identifying a trusted application installed on a computer, by checking a database of known trusted applications which contains information on protected information associated with each of the known trusted applications; collecting data relating to the identified trusted application and to programs installed on the computer; detecting, based at least partially on the collected data, whether one or more programs can access the protected information associated with identified trusted application without authorization, by emulating the operation of the one or more programs in a virtual environment, wherein a program is considered to be suspicious when it can access protected information of a trusted application without authorization; upon detecting at least one suspicious program, limiting the operation of the identified trusted application until the at least one suspicious program is terminated or removed from the computer; producing, based on both the data relating to the identified trusted application and data relating to the detected at least one suspicious program, a list of actions which need to be performed in order to remove the limitation of the operation of the identified trusted application wherein the list of actions comprises at least one of a step of pausing or terminating execution of the at least one suspicious program, and a step of removing the at least one suspicious program; and removing the limitation of the operation of the identified trusted application after executing said list of actions. identifying a trusted application installed on a computer, by checking a database of known trusted applications which contains information on protected information associated with each of the known trusted applications; collecting data relating to the identified trusted application and to programs installed on the computer; detecting, based at least partially on the collected data, whether one or more programs can access the protected information associated with identified trusted application without authorization, by emulating the operation of the one or more programs in a virtual environment, wherein a program is considered to be suspicious when it can access protected information of a trusted application without authorization; upon detecting at least one suspicious program, limiting the operation of the identified trusted application until the at least one suspicious program is terminated or removed from the computer; producing, based on both the data relating to the identified trusted application and data relating to the detected at least one suspicious program, a list of actions which need to be performed in order to remove the limitation of the operation of the identified trusted application wherein the list of actions comprises at least one of a step of pausing or terminating execution of the at least one suspicious program, and a step of removing the at least one suspicious program; and removing the limitation of the operation of the identified trusted application after executing said list of actions.