Patent ID: 8341744

Claim:
A computer-implemented method of protecting a computer system against malware, comprising: detecting initiation of a legitimate transactional web page session having an associated transactional web page; enumerating processes running on the computer system responsive to the detected initiation of the transactional web page session; enumerating window properties of windows associated with the running processes; evaluating at least one window property of a window associated with a process running on the computer system to determine whether the window property indicates that the process is an overlay-type identity stealer that overlays the window associated with the process over the legitimate transactional web page to dupe a user into entering credentials into the overlaid window, the evaluation comprising determining whether the process associated with the window has been authenticated and determining that the process is not an overlay-type identity stealer responsive at least in part to the process associated with the window having been authenticated; and blocking a behavior of the process for a duration of the session responsive to determining that the window property of the window associated with the process indicates that the process is an overlay-type identity stealer.