1. A process for monitoring and analyzing executable computer code comprising the steps of: providing a client computer having an event monitoring application in a working session, said client computer accessing a central computer through the computer network, said central computer having a database comprising a plurality of executable code identity signatures; detecting an event on a client computer by said monitoring application; identifying an executable code triggering the event and associated with an event; creating a unique signature of a said executable code with said monitoring application on said client computer; receiving in said central computer said unique signature; comparing said unique signature with said plurality of executable code identity signatures in said database; forwarding to said central computer for investigation said executable code when said unique signature is absent from plurality of executable code identity signatures; and investigating the identity and intent of the said executable code if it is unknown transmitting from the said central computer to said client computer at least one item selected from the group consisting of: a message and a command to the a monitoring application on a said client computer to perform a respective action.