Abstract: A web threat protection system may receive candidate uniform resource locators (URLs) from several URL sources. The candidate URLs may be received in a submission database. At least a portion of the candidate URLs is selected for further investigation by sending crawlers to retrieve objects from the selected URLs. The retrieved objects may be analyzed to determine whether they are malicious or good (i.e., not malicious). The result of the analysis may be used to build a security states database that includes security information of the selected URLs. Good URLs may be included in a safe URL sphere, which may be used to navigate to good websites on the Internet.

Abstract: Malicious codes may be prevented from performing malicious actions in a computer that does not have a virtual machine by simulating presence of the virtual machine. When a computer program performs an action in the computer, the action may be intercepted to determine if the computer program is malicious code probing the computer for presence of the virtual machine. A response to the action may be in accordance with convention of the virtual machine when the action is deemed to be for purposes of detecting the virtual machine. Otherwise, the action may be allowed to proceed.