Method, device and system for actively intercepting malicious programs

The invention discloses a method, a device and a system for actively intercepting malicious programs. The method for actively intercepting the malicious programs, provided by the embodiment of the invention comprises the following steps of: selecting an object needing to be intercepted according to the mode of a client-side for accessing key input data; setting intercepting executing information corresponding to the intercepted object in an application layer and/or a driver layer; acquiring the information of the programs accessing the key input data when the key input data is monitored; and allowing the programs to invoke the key input data when the programs are determined as safe programs according to the information of the programs, and intercepting the programs by the intercepting executing information when the programs are determined as malicious programs.