Abstract: A method for inhibiting infection of network destinations by malware comprising detecting behavior consistent with the presence of malware at first network clients, such as access by a message received at a first network client to addressing resources containing an address of a malware evaluator. Detecting malware at the first clients is advantageously accomplished at one or more malware evaluators by receipt of messages forwarded from the first network clients, the forwarded messages comprising selectively flagged information relating to malware suspicions. Malware evaluators advantageously comprise a Bayesian Learning Network trained with knowledge of malware characteristics and forwarded messages. The malware evaluators, when adequately trained, provide classifications of received messages as malware or not, with at least a predetermined likelihood. Results of such classification can be selectively made available to network clients, including the first network clients.