A method of making a determination of whether an electronic file stored at a client device is malware, the method comprising: receiving at a server from the client device a request message comprising signature information of the electronic file; querying a database storing signature information of a multiplicity of electronic files; if the signature information of the electronic file corresponds to signature information stored on the database, determining whether the electronic file is malware, wherein the signature information of the multiplicity of electronic files stored at the database includes signature information of clean copies of electronic files, and if the signature information relating to the electronic file corresponds to signature information of a clean copy of an electronic file stored at the database, determining that the electronic file is not malware, and/or known malware, and if the signature information relating to the electronic file corresponds to signature information of known malware stored at the database, determining that the electronic file is malware, the method being characterized by: in the event that the signature information of the electronic file does not correspond to signature information stored on the database, determining whether a predetermined number of further request messages relating to the electronic file are received from further client devices within a predetermined time period, and in the event that fewer than the predetermined number of further request messages are received within the predetermined time period, determining that the electronic file is likely to be malware; and sending the result of the determination to the client device. receiving at a server from the client device a request message comprising signature information of the electronic file; querying a database storing signature information of a multiplicity of electronic files; if the signature information of the electronic file corresponds to signature information stored on the database, determining whether the electronic file is malware, wherein the signature information of the multiplicity of electronic files stored at the database includes signature information of clean copies of electronic files, and if the signature information relating to the electronic file corresponds to signature information of a clean copy of an electronic file stored at the database, determining that the electronic file is not malware, and/or known malware, and if the signature information relating to the electronic file corresponds to signature information of known malware stored at the database, determining that the electronic file is malware, the method being characterized by: clean copies of electronic files, and if the signature information relating to the electronic file corresponds to signature information of a clean copy of an electronic file stored at the database, determining that the electronic file is not malware, and/or known malware, and if the signature information relating to the electronic file corresponds to signature information of known malware stored at the database, determining that the electronic file is malware, the method being characterized by: in the event that the signature information of the electronic file does not correspond to signature information stored on the database, determining whether a predetermined number of further request messages relating to the electronic file are received from further client devices within a predetermined time period, and in the event that fewer than the predetermined number of further request messages are received within the predetermined time period, determining that the electronic file is likely to be malware; and sending the result of the determination to the client device.