For example, consider the classic Zeus or SpyEye DIY malware construction ensemble. These packs include malware creators, distributors, exploit packs and management consoles all in one. How easy would it be for the malware created from these (and similar packs) to include the following?

· Detect whether the Web browser is open at the time the malware component is executed, and that the URL of the infector site is within the browser history. If not, then obviously this malware wasn't downloaded by this computer and it shouldn't act maliciously - so it won't be classed as malware by the automated analysis system.

· Check the date timestamp of the computer and if the malware installer component hasn't been executed within a couple of seconds of download from the infector site, then this probably isn't the victim's computer.

· Check the Web browser history to ensure that the computer frequently browses the Web (especially the day of infection) and that there are URLs that relate to the affiliates that drove the victim to the infector site. If not, then it wasn't downloaded from this computer and... well, you know the drill.

· Wait until the letter "T" has been pressed 100 times within an hour, and that the mouse has traveled the equivalent of 10 meters before initiating any malicious activities.