Patent Document ID: 9141797
Application ID: 14189730

Base Claim:
1. A method of detecting fake antivirus in a computer, the method comprising: retrieving text content of a graphical user interface (GUI) window of an application program; classifying the text content to determine that the application program belongs to an antivirus category; scanning a file of the application program for obfuscated binary code indicative of a fake antivirus; and deeming the application program to be fake antivirus based on a finding that the application program belongs to the antivirus category and the file of the application program has obfuscated binary code indicative of a fake antivirus.

---

Claim 2:
2. The method of claim 1 wherein retrieving the text content of the GUI window of the application program comprises: intercepting text changing operations performed by the application program to change text of the GUI window.