1. A method of investigating the effects of malicious software on a distributed computer system comprising a plurality of interconnected computers including a non-virtual computer, said method comprising: A) storing a plurality of local components of respective distributed malicious programs; B) trialling each of said plurality of said local components of respective distributed malicious programs in turn by: i) running, on said non-virtual computer, a first operating system program to provide a non-virtual execution environment for one local component of said plurality of local components; ii) configuring a boot loader program to load a second operating system program when said computer is rebooted; iii) running, in said non-virtual execution environment, said local component; iv) recording messages generated by said non-virtual computer when under control of each of said local components for transmission to one or more computers involved in the respective distributed malicious program of which said local component forms a part; and v) automatically replacing said execution environment with a clean copy of the execution environment in between each trial by: a) re-booting the non-virtual computer to load and run said second operating system program; b) running a refresh program on top of said second operating system program to replace said first operating system program with a clean copy of the first operating system program; c) configuring said boot loader program to load said first operating system program when said non-virtual computer is re-booted; and d) re-booting said non-virtual computer.