System, method, and apparatus for computer security

A method of protecting a computer, the method comprising:

• providing a first whitelists at the computer, the first whitelist having identifications for executable software;
• upon an attempt to initiate an executable on the computer, determining if the executable corresponds to one of the identifications in the first whitelist and if the executable corresponds to any one of the identifications in the first whitelist, allowing the executable to run;
• if the executable does not correspond to one of the identifications in the first whitelist, forwarding the executable to a server;
• upon reception of the executable, the server analyzing the executable at the server using heuristics to determine if a malware exists in the executable, if the malware exists in the executable, notifying regarding the malware, if the malware doesn't exists in the executable, updating the first whitelist and communicating with the computer, the computer allowing the executable to run;
• if it is not determined, the server queuing the executable for further research by a human researcher
• wherein the further research including a static analysis that comprises installing the executable on a clean computer that is isolated from a wide area network and scanning the executable with commercially available malicious software scan systems to determine if the executable includes the malicious software;
• and
• notifying regarding the malicious software by sending an email to a user of the computer, the email including a description of the malicious software, instructions for removing the malicious software, and links to training on how to prevent future intrusions of malicious software into the computer.

A computer program product for providing security to a computer comprising:

• a non-transitory storage medium having computer readable instructions stored therewith, the computer readable instructions being executable by a processor and comprising:
• the computer readable instructions running on the computer determining when an executable attempts to initiate on the processor;
• upon determining that the executable attempts to initiate, the computer readable instructions running on the processor determining if the executable is signed;
• if the executable is signed, the computer readable instructions running on the processor searching the first whitelist to see if the executable is present and if the executable is present on the first whitelist, the computer readable instructions running on the processor allowing the executable to run;
• if the executable is unsigned, the computer readable instructions running on the processor searching the second whitelist to see if the executable is present on the second whitelist and if the executable is present on the second whitelist, the computer readable instructions running on the processor allowing the executable to run;
• if the executable is not found in either the first whitelist or the second whitelist, the computer readable instructions running on the processor forward the executable to a server and computer readable instructions running on the server analyzing the executable using heuristics to determine if a malware exists in the executable;
• if the malware exists in the executable, the computer readable instructions running on the server notifying regarding the malware by sending an email to a user of the computer, the email including a description of the malware, instructions for removing the malware, and links to training on how to prevent future intrusions of malicious software into the computer;
• if the malware doesn't exist in the executable, the computer readable instructions running on the server updating the respective whitelist of the two whitelists and communicating with the computer readable instructions running on the computer, the computer readable instructions running on the computer then allowing the executable to run;
• if the computer readable instructions running on the server determine that there may be malware in the executable, the computer readable instructions running on the server queuing the executable for further research, the further research including a static analysis that comprises installing the executable on a clean computer that is isolated from a wide area network and scanning the executable with commercially available malicious software scan systems to determine if the executable includes the malicious software and when the executables include the malicious software, the computer readable instructions running on the server notifying regarding the malware by sending an email to a user of the computer, the email including the description of the malware, instructions for removing the malware, and links to training on how to prevent future intrusions of the malicious software into the computer.