Patent ID: 7523502

Claim:
A computer-implemented method of protecting a computer system against malware, comprising: detecting file activity on a local computer system; determining whether the file activity represents existence of a malware instance; dependent on the determination, querying a local anti-malware data store on the local computer system for anti-malware data for remediating the malware instance; responsive to determining that the local anti-malware data store does not contain the anti-malware data, querying a network resource for the anti-malware data; remediating the malware instance using anti-malware data received from the network resource; determining whether the malware instance has been remediated a threshold number of times using the anti-malware data received from the network resource; responsive to the malware instance having been remediated at least the threshold number of times, storing the anti-malware data received from the network resource in the local anti-malware data store; and responsive to the malware instance having not been remediated the threshold number of times, discarding the anti-malware data received from the network resource.