Granted Patent B2

US 7,721,333 · App. 11/334,318 · Granted May 18, 2010

Assignee: Webroot Software, Inc.

Abstract

Claims (41)

1. A method for detecting a keylogger on a computer, comprising:

creating, in a memory of the computer, a hidden window;

generating a unique, unpredictable data pattern;

inputting, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user;

scanning running processes in the memory other than a keylogger detection process for the unique, unpredictable data pattern; and

performing a secondary scan of a suspect process, the suspect process having an associated buffer that contains the unique, unpredictable data pattern.

2. The method of claim 1 , further comprising reporting the suspect process as a suspected keylogger, when the secondary scan confirms that the suspect process is likely to be a keylogger.

3. The method of claim 1 , wherein the hidden window comprises a single-pixel window on a display of the computer.

4. The method of claim 1 , wherein the hidden window is created outside of a display buffer of the computer.

5. The method of claim 1 , wherein the unique, unpredictable data pattern is based on a random value.

6. The method of claim 1 , wherein the unique, unpredictable data pattern is input to the hidden window multiple times.

7. The method of claim 1 , wherein inputting, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user comprises using an application program interface (API) of an operating system of the computer.

8. The method of claim 1 , wherein inputting, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user comprises using a keyboard driver that is integral to the keylogger detection process.

9. The method of claim 1 , wherein performing the secondary scan of the suspect process comprises:

identifying at least one application program interface (API) used by the suspect process; and

determining whether the suspect process uses the at least one API in a manner that is characteristic of a keylogger.

10. A system, comprising:

a processor; and

a memory connected with the processor, the memory containing a plurality of program instructions to detect a keylogger on a computer, the plurality of program instructions being configured to cause the processor to:

create, in the memory, a hidden window;

generate a unique, unpredictable data pattern;

input, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user;

scan running processes in the memory other than a keylogger detection process for the unique, unpredictable data pattern; and

perform a secondary scan of a suspect process, the suspect process having an associated buffer that contains the unique, unpredictable data pattern.

11. The system of claim 10 , wherein the plurality of program instructions are further configured to cause the processor to report the suspect process as a suspected keylogger, when the secondary scan confirms that the suspect process is likely to be a keylogger.

12. The system of claim 10 , wherein the hidden window comprises a single-pixel window on a display of the computer.

13. The system of claim 10 , wherein the plurality of program instructions are configured to cause the processor to create the hidden window outside of a display buffer of the computer.

14. The system of claim 10 , wherein the unique, unpredictable data pattern is based on a random value.

15. The system of claim 10 , wherein the plurality of program instructions are configured to cause the processor to input the unique, unpredictable data pattern to the hidden window multiple times.

16. The system of claim 10 , wherein the plurality of program instructions are configured to cause the processor to input, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user by using an application program interface (API) of an operating system of the computer.

17. The system of claim 10 , wherein the plurality of program instructions are configured to cause the processor to input, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user by using a keyboard driver that is integral to the keylogger detection process.

18. The system of claim 10 , wherein, during the secondary scan of the suspect process, the plurality of program instructions are configured to cause the processor to:

identify at least one application program interface (API) used by the suspect process; and

determine whether the suspect process uses the at least one API in a manner that is characteristic of a keylogger.

19. A computer-readable storage medium containing program instructions to detect a keylogger on a computer, comprising:

a first instruction segment to create, in a memory of the computer, a hidden window;

a second instruction segment to generate a unique, unpredictable data pattern;

a third instruction segment to input, to the hidden window, the unique, unpredictable data pattern in a manner that mimics keyboard input from a user;

a fourth instruction segment to scan running processes in the memory other than a keylogger detection process for the unique, unpredictable data pattern; and

a fifth instruction segment to perform a secondary scan of a suspect process, the suspect process having an associated buffer that contains the unique, unpredictable data pattern.

20. The computer-readable storage medium of claim 19 , further comprising a sixth instruction segment to report the suspect process as a suspected keylogger, when the secondary scan confirms that the suspect process is likely to be a keylogger.

Assignments (9)

Continuity (1)