An apparatus for protecting against computer malware, comprising: a data inputter for intercepting data units flow, a trust level assigner, associated with the data inputter, for assigning to each of the data units a respective trust level, an isolated-processing environment, operable to process the data units in an isolated manner and configured to send copies of the processed data units out of the isolated-processing environment, and a processing environment selector, associated with the trust level assigner and the isolated-processing environment, operable to determine if a data unit is to be executed on the isolated-processing environment, in accordance with the respective trust level.