A malware detection system to detect malware in a client computer system comprising: a behaviour profile generator adapted to generate a behaviour profile specifying operational behaviours of a computer system indicative of the existence of malware in the computer system; an interface adapted to communicate the behaviour profile to the client; and an identifier responsive to a message from the client that the behaviour profile is exhibited by the client and adapted to identify a reaction instruction for performance by the client, wherein the interface is further adapted to communicate the reaction instruction to the client.
