Various methods can be used:

• Samples are sent in by customers
• Malware detected by heuristic scanners (i.e. stuff that behaves like a virus) is further analysed
• Mail blocked as spam can be analysed for malware attachments.
• Malware in emails blocked as spam
• "honeypots", which are public servers or email addresses designed to collect malware
• going undercover in malware writers communities

Various methods can be used:

• Samples are sent in by customers
• Malware detected by heuristic scanners (i.e. stuff that behaves like a virus) is further analysed
• Mail blocked as spam can be analysed for malware attachments.
• "honeypots", which are public servers or email addresses designed to collect malware
• going undercover in malware writers communities