1. A method of determining whether suspicious code received by a data processing device is malware, comprising the steps of: (a) receiving the suspicious code at a port of the data processing device; (b) applying static analysis to the suspicious code; and (c) if the suspicious code passes said static analysis, applying disassembling analysis to the suspicious code.