They capture samples via honey pots and customer reports, un-package them, reverse engineer the executables so they can see the source code, and try to figure out what the malware is doing.

FORBES: Battleground Cyberspace: Hackers vs. White Hats