Patent ID: 8667586

Claim:
A method for identifying an origin of suspected pestware activity on a computer comprising: receiving, from a user via an interface of the computer, a time of interest relating to a suspicion of pestware on the computer; issuing a timestamp in response to the receiving the time of interest; identifying, in response to the issuing the timestamp, indicia of pestware, wherein the identifying includes: accessing at least one log of historical events on the computer; locating an indication of at least one event in at least one log that corresponds to the time of interest; and determining that the at least one event is associated with the indicia of pestware, wherein the determining that the at least one event is associated with the indicia of pestware includes following references in the at least one log to a suspected pestware object; and accessing at least a portion of a recorded history of sources that the computer received files from so as to identify, based at least in part upon the identified indicia of pestware, a reference to an identity of a source that is suspected of originating pestware.