1. A method of investigating the effects of malicious software on a distributed computer system comprising a plurality of interconnected computers including a test computer, said method comprising the steps of a) storing a plurality of local components of respective distributed malicious programs; b) trialling each of said plurality of local components in turn by: i) running, on said test computer, an execution environment program to provide an execution environment for said local component; ii) running, in said execution environment, said local component; and iii) recording messages generated by said test computer when under control of each of said local components for transmission to one or more computers involved in the malicious distributed program of which said local component forms a part; and c) automatically replacing said execution environment with a clean copy thereof in between each trial.