A method of distributed detection of malware, the method comprising: deploying a first security client on a first computer node, wherein the first security client is operable to identify and communicate with a plurality of second security clients deployed on respective second computer nodes (120, 130) located in a local or remote computer network; performing, by the first computer node executing the first security client, a malware analysis of files on the first computer node; identifying an unknown file that could not be determined as either malicious or clean by the malware analysis; collecting, by the first security client, information and statistics data about the unknown file generated during malware analysis of the unknown file by the first security client; transmitting, by the first security client, to the plurality of second computer nodes (120, 130), a request for identification information and remediation tool for the unknown file; receiving from two or more second security clients deployed on two or more second computer nodes (120, 130) responses containing indications of the availability of requested information; selecting, by the first security client, out of the two or more second computer nodes (120, 130) one second computer node as a source for obtaining the requested information, wherein the selecting is based on a geographic proximity of the selected second computer node to an origin of the unknown file; requesting from the selected second computer node the identification information and remediation tool for the unknown file; receiving from the selected second computer node a response containing the identification of the unknown file as a malicious file and a malware remediation tool for the identified malicious file, wherein the remediation tool includes information, statistics data and malware repair or removal instructions for the malicious file; updating a local malware database on the first computer node with the identification of the unknown file as the malicious file and the malware remediation tool; and using, by the first security client, the received identification and malware remediation tool to repair the malicious file or remove the malicious file from the first computer node. deploying a first security client on a first computer node, wherein the first security client is operable to identify and communicate with a plurality of second security clients deployed on respective second computer nodes (120, 130) located in a local or remote computer network; performing, by the first computer node executing the first security client, a malware analysis of files on the first computer node; identifying an unknown file that could not be determined as either malicious or clean by the malware analysis; collecting, by the first security client, information and statistics data about the unknown file generated during malware analysis of the unknown file by the first security client; transmitting, by the first security client, to the plurality of second computer nodes (120, 130), a request for identification information and remediation tool for the unknown file; receiving from two or more second security clients deployed on two or more second computer nodes (120, 130) responses containing indications of the availability of requested information; selecting, by the first security client, out of the two or more second computer nodes (120, 130) one second computer node as a source for obtaining the requested information, wherein the selecting is based on a geographic proximity of the selected second computer node to an origin of the unknown file; requesting from the selected second computer node the identification information and remediation tool for the unknown file; receiving from the selected second computer node a response containing the identification of the unknown file as a malicious file and a malware remediation tool for the identified malicious file, wherein the remediation tool includes information, statistics data and malware repair or removal instructions for the malicious file; updating a local malware database on the first computer node with the identification of the unknown file as the malicious file and the malware remediation tool; and using, by the first security client, the received identification and malware remediation tool to repair the malicious file or remove the malicious file from the first computer node.