System and method of limiting the operation of trusted applications in presence of suspicious programs

A system for limiting the operation of trusted applications in presence of suspicious programs, the system comprising:

• a memory storing a plurality of software applications and program;
• and
• a hardware processor coupled to the memory and configured to:
• identify one or more trusted applications in the memory;
• collect data relating to the identified one or more trusted applications and to the programs;
• detect, based at least partially on the collected data, one or more suspicious programs using suspicious program detection rules indicating that the one or more suspicious programs can access protected information of a given trusted application of the identified one or more trusted applications without authorization;
• upon detecting at least one suspicious program, temporarily limit an operation of the given trusted application;
• produce, based on both the data relating to the identified one or more trusted applications and data relating to the detected at least one suspicious program, a list of actions to remove or terminate the at least one suspicious program from the computer;
• and
• remove limitation of the operation of the given trusted application after the list of actions are performed to remove or terminate the at least one suspicious program from the computer.

A computer program product, stored on a non-transitory computer readable medium, wherein the computer program product includes computer executable instructions for limiting the operation of trusted applications in presence of suspicious programs, including instructions for:

• identifying one or more trusted applications installed on a computer;
• collecting, by the hardware processor, data relating to the identified one or more trusted applications and to programs installed on the computer;
• detecting, based at least partially on the collected data, one or more suspicious programs using suspicious program detection rules indicating that the one or more suspicious programs can access protected information of a given trusted application of the identified one or more trusted applications without authorization;
• upon detecting at least one suspicious program, temporarily limiting an operation of the given trusted application;
• producing, based on both the data relating to the identified one or more trusted applications and data relating to the detected at least one suspicious program, a list of actions to remove or terminate the at least one suspicious program from the computer;
• and
• removing limitation of the operation of the given trusted application after the list of actions are performed to remove or terminate the at least one suspicious program from the computer.