1. A system for detecting malicious software comprising: a) an application processor comprising: i) a virtual machine monitor configured to operate on a hardware computing machine under control of a host operating system; ii) at least one network application template, each of the “at least one network application template” including: (1) a modifiable section; and (2) a non-modifiable section; iii) at least one container, at least one of the at least one container: (1) configured to operate in a protected memory space under control of a guest operating system virtual machine; (2) initialized with at least one copy of the “at least one network application template; and (3) including: (a) a file system; and (b) a network address; iv) a detection module configured to operate under control of the “guest operating system virtual machine, the detection module comprising: (1) a trigger detection module configured to monitor activity on the “at least one container” for a trigger event; (2) a logging module configured to write activity to an activity report in response to the trigger event; and (3) a container command module configured to conditionally issue at least one command in response to the trigger event, the “at least one command being at least one of the following: (a) a container stop command; (b) a container revert command; and (c) a container start command; v) a virtual machine control console configured to: (1) operate under control of the “host operating machine;” and (2) start and stop the “hardware virtual machine monitor;” vi) a container control module configured to: (1) operate under control of the “guest operating system virtual machine;” (2) to start at least one of the “at least one container” in response to the container start command;” (3) to stop at least one of the “at least one container” in response to the container stop command;” and (4) to revert at least one of the “at least one container” in response to the container revert command;” and vii) a server communication module configured to transmit the activity over a network; and b) the central collection network appliance configured to: i) receive over the “network” at least one of the “at least one activity report;” and ii) maintain a repository of activities for infected devices.