Collecting and analyzing malware data

A computer system for detecting and removing malicious applications, the system comprising:

• a threat detection component configured to detect events on a client computer that indicate a potential malicious application;
• an information collection component configured to collect at the client computer information about the potential malicious application;
• a communication component configured to communicate threat reports from the client computer to a back-end service and signatures for detecting malicious applications from the back-end service to the client computer;
• a threat data store configured to store information about potential malicious applications reported by client computers, a queue of potential malicious applications waiting to be analyzed, signatures for detecting malicious applications, and mitigation instructions for removing malicious applications from client computers;
• a threat analysis component configured to analyze received threat reports;
• a signature builder component configured to receive information about analyzed threats from the threat analysis component and create a signature for detecting instances of the threat;
• and
• a mitigation component configured to apply signatures and mitigation instructions to identify known threats and carry out mitigation actions in response to identified threat instances.

A computer-readable storage medium encoded with instructions for controlling a computer system providing a back-end service to collect and analyze malware threats reported by client computers, by a method comprising:

• receiving a threat report from a client computer that identifies a malware threat;
• classifying the malware threat based on previously analyzed threats;
• building a signature for detecting the malware threat;
• determining mitigation actions for neutralizing the malware threat and producing a mitigation script based on the mitigation actions;
• and
• providing the signature and mitigation script to the client computer.