Abstract: With the development of E-commerce， the wide application of E-bank and the growing sophistication of RootKit technology， information stealing from these application systems keeps increasing. It becomes much harder to detect malicious software. Based on the theories of E-bank keyboard protection module， a comparatively sound keyboard data entry protection strategy， targeting the detection of currently-popular RookKit， is proposed. By adopting a more safe and reliable keyboard data entry method， this strategy achieves a better result of protecting users’ data entry.

Key words: filter drivers, RootKit, IRQ, IRP