Patent ID: 8474040

Claim:
A method for determining whether a computer program, addressed to a first computer having a plurality of files different than the computer program, includes malware, the method comprising the steps of: a second computer receiving the computer program via a network; in response to receiving the computer program the second computer, requesting from the first computer identification of the plurality of files in the first computer and at least one of respective creation dates and respective last edit dates of the plurality of files in the first computer; listing in a file in the second computer, without installing the plurality of files in the second computer, identities of the plurality of files in the first computer and the at least one of the respective creation dates and respective last edit dates obtained from the first computer for the respective plurality of files in the first computer; creating, for the computer program, a simulated operating environment in the second computer using the file having the listing of identities of the plurality of files in the first computer and the at least one of the respective creation dates and respective last edit dates; executing the computer program in the second computer; and the second computer determining whether the computer program attempts to access or utilize the plurality of files in a manner indicative of malware, and if so, the second computer generating a first record that the computer program exhibits a characteristic of malware, and if not, the second computer generating a second record that the computer program is does not exhibit a characteristic of malware.