Patent ID: 8453244

Claim:
A malware detection method for a server, the server connecting to a first user device and a second user device via a network, the malware detection method comprising the following steps of: (a) enabling the server to receive at least one first execution record from a client module of the first user device; (b) enabling the server to store the at least one first execution record of the first user device into a recording list; (c) enabling the server to determine that a malware exists in the first user device according to the recording list, and transmit a malware notice to the first user device; (d) enabling the server to receive at least one second execution record from a client module of the second user device; (e) enabling the server to store the at least one second execution record of the second user device into the recording list; and (f) enabling the server to determine whether the malware is copied from the first user device to the second user device or copied from the second user device to the first user device according to the recording list.