13. The computer system of claim 11 , wherein a digest of downloaded executable content comprises a cryptographic hash of the executable content.
11. A computer system for identifying legitimate content, comprising: a computer-readable storage medium storing executable computer program instructions comprising instructions for: examining executable content download requests from legitimate applications known to not contain malware to identify user-agent strings used by the legitimate applications; establishing, responsive to the examining, a list of trusted user-agent strings used by the legitimate applications to request executable content; identifying executable content downloaded from the network using the trusted user-agent strings in the list by receiving content download descriptions from a plurality of traffic interception modules connected to a network, the traffic interception modules examining traffic exchanged between clients and servers on the network; generating identifiers of the executable content downloaded from the network using trusted user-agent strings in the list, the identifiers including digests of the downloaded executable content; adding the generated identifiers of the executable content downloaded from the network using trusted user-agent strings to a white list of legitimate executable content; and providing a client with access to the white list of legitimate executable content, wherein the client is adapted to use the white list to identify legitimate executable content at the client; and a processor for executing the computer program instructions.