1. A method for analyzing a computing system, comprising: at a first moment in time, scanning the resources of the computing system for indications of malware; at a second moment in time: scanning the resources of the computing system for indications of malware; and, determining one or more system executable objects loaded on the computing system; determining one or more system changes, wherein the system changes comprise one or more differences between the results of scanning the resources of the computing system for indications of malware at the second moment of time and the first moment in time; identifying a relationship between the system changes and the one or more system executable objects loaded on the computing system; identifying as malicious the one or more system executable objects loaded on the computing system for which a relationship with the system changes has been identified.