Environmental imaging

A computer system for determining whether a computer program addressed to a first computer having a plurality of files different than the computer program, includes malware, the computer system comprising:

• a central processing unit (CPU);
• a computer readable memory, the computer readable memory in communication with the CPU;
• a computer readable tangible storage device;
• first program instructions to instruct a second computer to obtain a file including a plurality of environment details of the first computer, the plurality of environment details including one of creation dates and last edit dates for the plurality of files in the first computer;
• second program instructions to create in the second computer, without installing the plurality of files in the second computer, a simulated environment using the file, the simulated environment simulating the presence of the plurality of files in the first computer and the plurality of environment details;
• third program instructions to instruct the second computer to execute the computer program in the simulated environment in the second computer;
• and
• fourth program instructions to determine whether the computer program attempts to access or utilize the plurality of files in a manner indicative of malware, and if not, instruct the second computer to perform one of recording and generating a notification that the computer program does not exhibit a characteristic of malware;
• and wherein the first, second, third and fourth program instructions are stored on the computer readable tangible storage device for execution by the CPU via the computer readable memory.

A computer program product for determining whether a computer program addressed to a first computer including a plurality of files different than the computer program, includes malware, the computer program product comprising:

• a computer readable tangible storage device;
• first program instructions to instruct a second computer to obtain a file including a plurality of environment details of the first computer, the plurality of environment details including one of creation dates and last edit dates for the plurality of files in the first computer;
• second program instructions to create in the second computer, without installing the plurality of files in the second computer, a simulated environment using the file, the simulated environment simulating the presence of the plurality of files in the first computer and the plurality of environment details;
• third program instructions to instruct the second computer to execute the computer program in the simulated environment in the second computer;
• and
• fourth program instructions to instruct the second computer to determine whether the computer program attempts to access or utilize the plurality of files in a manner indicative of malware, and if not, the second computer performing one of recording and generating a notification that the computer program is not malware,
• wherein the first, second, third and fourth program instructions are stored on the computer readable tangible storage device.