1. A computer system configured to improve security of a client computer, the system comprising: a memory; one or more processors coupled to the memory; a malware detection logic coupled to the memory and the one or more processors, and configured to: receive a first file from a viewer program that is executing on the client computer, wherein the first file is a mixed content file comprising a combination of both executable instructions and data in one or more formats, and/or one or more data sets stored in one or more other formats; determine that the first file is formatted according to a first specification and that the first specification is associated with one or more first malware tests of a plurality of malware tests, wherein each test in the plurality of malware tests is associated with a score; execute each test in the first one or more malware tests, and add, to a first total score, the score associated with the test if the first file satisfies the test, wherein the first one or more malware tests comprises at least one of: determining that the first file is marked as password encrypted and further determining that the first file specifies a password to decrypt the first file as a blank password; or determining that the first file includes one or more JavaScript instructions after an End-of-File (EOF) tag present in the file, wherein the EOF tag is an indicator of the end of the file; determine the first total score satisfies a first threshold, and in response, send data to the viewer program indicating that the first file is likely to include malware.