Patent ID: 8321910

Claim:
A method for determining a source of a selected malware file in a user computer system, the method comprising: receiving a selection from a user on a first graphical user interface identifying a known malware file in said user computer system for analysis; receiving on said first graphical user interface an indication from said user to execute a function to determine said source of said known malware file; determining the creation date of said selected malware file; searching a file system associated with said user computer system for a file based on said creation date of the selected malware file; locating said file, said file being different from said malware file; determining that the creation date of said file of said file system matches said creation date of said selected malware file; and generating source information identifying at least one potential source of said selected malware file based on said matching, said source information including said file; providing a second graphical user interface for displaying the source information, wherein said source information includes a file name of said file; and displaying said source information on said computer system.