1. A method of determining the identity of suspected malware on a client device, the method comprising: 1) sending information pertaining to said malware and/or an electronic file from the client device to a network server; 2) at the network server, using said information to determine a first required information set; 3) sending to the client device a request for the required information set; 4) at the client device, comparing the required information set with information stored at the client device, and returning the results of the comparison to the network server; 5) at the network server, using the results of the comparison to attempt to determine an identity of the malware; 6) in the event that the results of the comparison indicate that the suspected malware is one of a plurality of types of malware, using the results of the comparison to determine a new required information set and repeating steps 2 to 6; and 7) determining the identity of the suspected malware from the results of the comparison or determining that the suspected malware is unknown to the network server.