1. A computer-readable memory configured with data and with instructions that when executed by at least one processor causes the processor(s) to perform a process for identifying software program code as a malware detection signature generation candidate, the software program configured to run on a virtual machine, the process comprising the computational steps of: receiving an identification start state in the memory, the start state being a state of the virtual machine while the program was running, and in particular being a state of the virtual machine for which a determination is made that the program code should be investigated as a possible carrier of malware; placing in a set of variables of interest in the memory at least one variable which is visible in the identification start state, namely, a variable which is within scope and could be assigned a value; searching previously executed states of the virtual machine for any assignment of a variable that belongs to the set of variables of interest; putting into a set of assignments of interest in the memory an assignment that was found by the searching step; when the set of assignments of interest contains a nonterminated assignment having at least one source parameter variable, placing the source parameter variable(s) of that nonterminated assignment in the set of variables of interest and then repeating the searching and putting steps; when the set of assignments of interest does not contain a nonterminated assignment having at least one source parameter variable, identifying as the malware detection signature generation candidate a region of code which is defined by the set of assignments of interest.