16. A method of detecting fake antivirus software, said method comprising: collecting keywords that are comprehensible words by monitoring system behavior of a plurality of executing fake antivirus software samples and storing said keywords in a keyword database; identifying an executing process in a computer, said process being legitimate antivirus software; retrieving a rule from a rule database, said rule using two or more of said keywords to identify fake software; retrieving said keywords from said keyword database, each of said keywords being indicative of fake antivirus software; applying said rule to said executing process and determining that keywords of said rule match data in said process executing in a memory of said computer by scanning said process in said memory; determining, after said step of applying, that said process is not legitimate antivirus software when a digital certificate of said process is nonexistent or is invalid, when an identification of said process does not exist in a white list of valid processes, or when a company name associated with said process does not exist in a white list of valid company names; and displaying, on said computer, an indication that said process is fake antivirus software based on said applying and said determining.
16. A method of detecting fake antivirus software, said method comprising: collecting keywords that are comprehensible words by monitoring system behavior of a plurality of executing fake antivirus software samples and storing said keywords in a keyword database; identifying an executing process in a computer, said process being legitimate antivirus software; retrieving a rule from a rule database, said rule using two or more of said keywords to identify fake software; retrieving said keywords from said keyword database, each of said keywords being indicative of fake antivirus software; applying said rule to said executing process and determining that keywords of said rule match data in said process executing in a memory of said computer by scanning said process in said memory; determining, after said step of applying, that said process is not legitimate antivirus software when a digital certificate of said process is nonexistent or is invalid, when an identification of said process does not exist in a white list of valid processes, or when a company name associated with said process does not exist in a white list of valid company names; and displaying, on said computer, an indication that said process is fake antivirus software based on said applying and said determining. 19. The method as recited in claim 16 further comprising: displaying, on said computer, registry information associated with said process; and cleaning said registry information from said computer.