1. A system for detecting malicious software comprising: a) at least one network application template, the at least one network application template including: i) a modifiable section; and ii) a non-modifiable section; b) an application processor comprising: i) a virtual machine monitor to execute on a hardware computing machine under control of a host operating system; ii) at least one container: (1) to execute in a protected memory space under control of a guest operating system virtual machine; (2) initialized with at least one copy of the at least one network application template; and (3) including: (a) a file system; and (b) a network address; iii) a detector to execute under control of the guest operating system virtual machine, the detector of the application processor to: (1) monitor activity on the at least one container for a trigger event; (2) write an indication of the activity to an activity report in response to the trigger event; and (3) conditionally issue at least one command in response to the trigger event, the at least one command being at least one of the following: (a) a container stop command; (b) a container revert command; and (c) a container start command; iv) a virtual machine control console to: (1) operate under control of the host operating system; and (2) start and stop the virtual machine monitor; v) a container controller to: (1) operate under control of the guest operating system virtual machine; (2) start the at least one container in response to the container start command; (3) stop the at least one container in response to the container stop command; and (4) revert the at least one container in response to the container revert command; and the application processor to transmit the activity report over a network to a central collection network appliance to store the indication of the activity from the activity report in a repository of activities for infected devices.