7. A method of detecting fake antivirus in a computer, the method comprising: receiving text content of a user interface of an application program; finding that the application program belongs to an antivirus category based on a classification of the text content of the user interface of the application program; and scanning a file of the application program for obfuscated binary code indicative of a fake antivirus.
9. The method of claim 7 wherein the user interface of the application program comprises a graphical user interface (GUI) window of the application program.