Patent ID: 8196205

Claim:
A method for detecting sources that are accessible over a network and which install spyware or other undesired content, the method comprising the steps of: (a) producing a virtual machine on a computing device and installing an operating system on the virtual machine to create a virtual machine environment useful for testing a potential source accessible on the network, to determine if the potential source that is to be tested attempts to install spyware on the computing device of a user; (b) automatically loading the potential source available on the network, within the virtual machine environment; and (c) determining if the potential source has at least attempted to install spyware in the virtual machine environment; wherein the potential source include a Web page component that is being rendered by a browser program, and wherein the step of loading the potential source within the virtual machine environment comprises further steps of: (a) executing a browser program within the virtual machine environment; (b) requesting the web page that comprises one of the potential sources from a remote site on the network using the browser program; (c) loading the web page into the browser program so that it is rendered; (d) detecting one of a plurality of predefined triggers that are fired as a result of the web page being loaded into the browser program and rendered; and (e) if the plurality of predefined triggers is detected, determining that the web page is at least attempting to perform a drive-by attack in the virtual machine environment.