1. A method of identifying sections of code that can be disregarded when detecting features that are characteristic of malware, which features are subsequently used for detecting malware, the method comprising: for each of a multiplicity of sample files stored in at least one computer readable memory, 1) subdividing file code of the sample file into a plurality of code blocks; 2) removing duplicate code blocks to leave a sequence of unique code blocks; 3) comparing the sequence of unique code blocks with those obtained for other sample files in order to identify standard sections of code; and 4) including any identified standard sections of code within a database such that those sections of code can subsequently be disregarded when identifying features characteristic of malware.