14. A computer system comprising: a logical processor; a memory in operable communication with the logical processor; an abstract syntax data structure representation of a software program code residing in the memory; a start state of a virtual machine residing in the memory, the start state being a state of the virtual machine during a run of the software program code on the virtual machine, and in particular being a state of the virtual machine for which a determination is made that the software program code should be investigated as a possible carrier of malware; a set of one or more variables of interest residing in the memory and including at least one variable which is visible in the start state, namely, a variable which is within scope in the start state and could be assigned a value; a set of previously executed states of the virtual machine; and a signature candidate generator including code which upon execution by the logical processor will utilize the abstract syntax data structure representation and the virtual machine start state to identify a set of assignments of interest at least in part by searching previously executed states of the virtual machine for any assignment of a variable that belongs to the set of variables of interest and putting in the set of assignments of interest at least one assignment in the software program code that is visible to at least one variable of the start state, and wherein the set of assignments of interest includes said assignment on the basis of said visibility in that without said visibility said assignment would not be included in the set of assignments of interest, and when the set of assignments of interest contains a nonterminated assignment having at least one source parameter variable, placing the source parameter variable(s) of that nonterminated assignment in the set of variables of interest and then repeating the searching, and when the set of assignments of interest does not contain a nonterminated assignment having at least one source parameter variable, identifying as a malware detection signature generation candidate a region of code which is defined by the set of assignments of interest.
15. The system of claim 14 , wherein the system further comprises parser code which upon execution by the logical processor will parse at least one of the following: an input HTML file which contains the software program code, an input PDF file which contains the software program code.