1. A method of detecting malware or potentially unwanted programs, the method comprising: at each of a plurality of client terminals, when it is determined that a program may be malware or a potentially unwanted program, generating image recognition data from displayed image data that includes image elements generated by the program, and sending the image recognition data to a central server; at the central server, storing the received image recognition data, and using the stored image recognition data to detect a presence of a malware or potentially unwanted program at the plurality of client terminals; and at each of the plurality client terminals, in addition to generating image recognition data, generating indexing information from the displayed image data, the indexing information being sent to the central server for storage with the image recognition data.