1. A method of detecting fake antivirus in a computer, the method comprising: retrieving text content of a graphical user interface (GUI) window of an application program; classifying the text content to determine that the application program belongs to an antivirus category; scanning a file of the application program for obfuscated binary code indicative of a fake antivirus; and deeming the application program to be fake antivirus based on a finding that the application program belongs to the antivirus category and the file of the application program has obfuscated binary code indicative of a fake antivirus.