1. A computer system that identifies malware in received files, comprising: a processor; a computer connection for receiving a file; and a memory; wherein the computer system is configured to, receive a file with multiple parts, wherein the multiple parts include at least one superficial data area within the file and a plurality of permanent data areas within the file, wherein the at least one superficial data area is different from the plurality of permanent data areas; determine whether the file is a user-modifiable file based on identifying the at least one superficial data area of the file representing a user data area modifiable by a user and whose modification has no effect on potential malware within the plurality of permanent data areas; and when the file is a user-modifiable file: filter out the at least one superficial data area of the file to define a remaining unfiltered portion of the file, wherein the unfiltered portion of the file includes a combination of the plurality of permanent data areas; generate a file signature from only a filtered version of the file based on the remaining unfiltered portion of the file; ascertain a level of trustworthiness of the file by comparing the file signature against file signatures included in a white list and corresponding to files known to be trustworthy, wherein the level of trust-worthiness is based on a corresponding level of trustworthiness of a matching file signature included in the white list; admit the file according to the level of trustworthiness of the file; and determine at least one constraint to apply to the file based on the level of trustworthiness associated with the file.