1. A method comprising: obtaining, by a visual algorithm stored in memory and executed by at least one processor of a first computer, a candidate character string associated with a potentially malicious computer item operating on a second computer; generating, by the visual algorithm during execution by the at least one processor, a first visual identifier (ID) by at least translating the candidate character string into the first visual ID in accordance with one or more translation rules stored on the first computer, the first visual ID is different from the candidate character string; generating a value representing a characteristic of the potentially malicious computer item, the characteristic being associated with a size of the potentially malicious computer item or a memory location associated with the potentially malicious computer item; analyzing the first virtual ID with a reference ID where a comparison between the first virtual ID and the reference ID is used to determine whether the potentially malicious computer item should be identified as a malicious computer item; and in response to the comparison between the first virtual ID and the reference ID being indeterminate as to whether the potentially malicious computer item is to be identified as a malicious computer item, further analyzing the characteristic of the potentially malicious computer item by determining whether the value falls outside an expected range of values associated with a non-malicious computer item.