Patent ID: 7908652

Claim:
A computer program embodied in a non-transitory computer-readable medium for scanning a computer for observer programs, the computer program comprising: observer data comprising a plurality of observer program characteristics descriptive of a plurality of observer programs where the observer programs are programmed to observe activities on a computer system and to create log data, and wherein the log data includes screen shots, program usage and web sites visited; reading instructions that read memory of the computer to obtain memory data; comparing instructions that compare the plurality of observer program characteristics with memory data characteristics to determine whether an observer program is present on the computer; generating instructions that generate results from the comparing, wherein the results generated indicate whether the observer program is present on the computer; countermeasure instructions that alter the operation of the observer program; outputting instructions that provide the results through a graphical user interface and that prompt as to whether the countermeasure instructions should be executed, wherein the countermeasure instructions are executable to (1) temporarily disable the observer program, (2) permanently disable the observer program, and (3) create decoy observer created data but wherein the observer program continues running; disabling instructions to disable the observer program if it is present on the computer, the disabling instructions implementing a method comprising: entering a startup command to load a kill program before the observer program is started; rebooting the computer; starting the kill program by execution of the startup command; and deleting an observer program startup command so that the observer program is not started.