Abstract: A system and method for managing malware is described. One embodiment is designed to receive an initial URL associated with a Web site; download content from that Web site; identify any obfuscation techniques used to hide malware or pointers to malware; interpret those obfuscation techniques; identify a new URL as a result of interpreting the obfuscation techniques; and add the new URL to a URL database.

Abstract: A system and method for managing malware is described. One embodiment includes a downloader for downloading portion of a Web site, a parser for parsing the downloaded portion of the Web site; an active browser for identifying changes to the known configuration of the active browser, wherein the changes are caused by the downloaded portion of the Web site; and a definition module for generating a definition for the potential malware based on the changes to the known configuration.

Abstract: A system and method for managing malware is described. One embodiment includes the steps of recording the original configuration information for an active browser system; operating potential malware on the active browser system; recording changes to the original configuration information; determining whether the changes to the original configuration information indicate that the potential malware is malware; and generating a definition for the malware.