A system, method and computer program product are provided for detecting viruses in software. Initially, data is compared with a plurality of virus definitions in a first database. If the data is successfully compared with at least one of the virus definitions, a security event is executed. The data is then compared with fingerprints of innocent data in a second database. If the data is successfully compared to the fingerprints of innocent data, access to the data is permitted. If, however, the data is unsuccessfully compared to the virus definitions and the fingerprints of innocent data, information is transmitted over a network for analysis purposes.