Methods and apparatus for dealing with malware

An apparatus for classifying a computer object as malware, the apparatus comprising:

• a base computer arranged to receive data about a computer object from each of plural remote computers on which the object or similar objects are stored or processed;
• wherein the base computer comprises plural threat servers arranged to receive the data from the plural remote computers and apply rules or heuristics against that data in real time to determine whether or not the object is malware and to communicate the determination to the remote computers;
• the base computer further comprising at least one central server in communication with the threat servers and arranged to receive the data about objects from the servers to maintain a master database of data received about objects from all threat servers.

A method of connecting a remote computer to one of a plurality of servers, the method comprising:

• installing an agent program on the remote computer, the agent program having an algorithm for allocating the remote computer to a server determined by the time when the agent program was installed;
• and
• connecting the agent program to the allocated server.