1. A system that detects the state of a computer network, comprising: a plurality of distributed agents disposed in said computer network, each said distributed agent comprising: data collection means for passively collecting, monitoring, and aggregating data representative of activities of respective nodes within said computer network; means responsive to the data from the data collection means for analyzing said data to develop activity models representative of activities of said computer network in a normal state and activities of said computer network in an abnormal state as a result of intrusions, infections, scams and/or other suspicious activities in said computer network; and means for generating counter-offensive measures where unauthorized access to a program or file containing executable code results in the program or file disabling an operating system with all associated applications of a computer in the computer network until/unless the presumed attacker is able to prove to the machine owner/victim that the presumed attacker had been authorized to access the target data or machine provoking the said counter offensive measure.