Abstract: A method for identifying and removing malicious code uses a personal computing device that can communicate with a remote server. The remote server manages a blacklist and a whitelist. The blacklist is a list of programs that are known to contain malicious code. The whitelist is a list of programs that are known to be free of malicious code. The method begins when a scan request is received. The scan request is a command that directs the personal computing device to work with the remote server to perform a scan of a collection of files that will identify malicious code. The method then performs a sandboxed-evaluation process to identify files that are found to contain malicious code. The sandboxed-evaluation process is an isolated testing routine that runs program files to detect malicious code. Finally, the method executes a threat remediation process if malicious code is found.