Patent ID: 8312539

Claim:
A computer-implemented method for detecting malicious code on a client, the method comprising: detecting, using a computer, a pop-up displayed on the client by an executing source application; determining, using the computer, a reputation associated with the source application; when the reputation associated with the source application indicates that the source application is suspicious, prompting, using the computer, a user to provide feedback about the pop-up; responsive to negative feedback about the pop-up, declaring, using the computer, the source application to be malicious software; and after declaring the source application to be malicious software: blocking, using the computer, a subsequent attempt by the executing source application to display a subsequent pop-up on the client; tracking, using the computer, executable code produced by the executing source application to identify one or more new code modules on the client as originating from the source application; and blocking, using the computer, attempts by the new code modules to display a new pop-up on the client.