1. A computer-implemented method comprising: providing a virus signature file on a host computing system, the virus signature file being updated regularly from an external central security server; detecting malicious code on a host computer system; determining that the virus signature of said host computer system does not include a virus signature of said malicious code; determining whether a locally stored blacklist of said host computer system comprises a malicious code identifier of said malicious code; creating said malicious code identifier locally on said host computer system upon a determination that said blacklist does not comprise said malicious code identifier; and updating said locally stored blacklist with said malicious code identifier; notifying the central security server of the malicious code identifier, wherein the central security server further stores the notification separately from the virus signature file updates; wherein the central security server determines whether more than a threshold number of notification counts of said malicious code identifier has been reached, upon which time the central security server distributes a certified virus definition having the virus signature file updates, including the malicious code identifier, to a least a member of public; and wherein a malicious code blacklist updating and protection application, initially installed in the security server, can be transferred to the host computer system.