Abstract: In general, one aspect of the subject matter described in this specification can be embodied in a system that includes a network-based information server system; and a computer operable to interact with a user interface device and operable to perform operations including: receiving from the network-based information server system status information corresponding to software applications, the status information including black-list information and phoenix-list information; updating a local cache, retained by the computer, with the status information received from the network-based information server system; generating an identifier for a software application, using a digital certificate and a hash value, when the software application is launched on the computer; checking the identifier for the software application against the status information; and notifying a user of the computer when a match is found during the checking.