1. A computer system for identifying malware in received files, the computer system comprising: a processor; a communication connection for receiving a file; and a memory; wherein the computer system is configured such that, upon receiving a file at the communication connection: determines whether the received file is a user-modifiable file, and if so: selects those portions of the received file that are more permanent; generates a file signature based on those selected portions of the received file that are more permanent; and determines whether the received file is malware based on the generated file signature.