Patent ID: 8028301

Claim:
A method of restricting recordal of user activity in a processing system, the method comprising: establishing an application programming interface (API) hook between API calls and API procedures of the processing system; registering an occurrence of an event in the processing system; notifying one or more processes in a hook chain of the occurrence of the event; notifying a process that is not in the hook chain of the occurrence of the event; intercepting a kernel API call of the processing system, wherein the kernel API call is initiated by the process that is not in the hook chain; determining if the process initiating the kernel API call is malicious, wherein the process is a keylogger program; and, in response to a positive determination; determining parameters of the intercepted kernel API call, wherein the parameters comprise information relating to a request for an API procedure of the processing system; generating process information for the process initiating the kernel API call, wherein the process information comprises: identity information for the process; and the determined parameters of the intercepted kernel API call; generating a file comprising the process information; storing the file in a storage device, wherein the storage device stores additional files that comprise process information for additional processes that initiated malicious kernel API calls; performing a behavioral analysis of the process by continually polling the state of the file in the storage device; preventing the process from establishing a hook function in the hook chain of the processing system based on the behavioral analysis; terminating the process; notifying a user in real-time when the process is terminated; and displaying a list of previously terminated processes to the user, wherein the list is generated from the files stored in the storage device.