1. A method of detecting malicious software, said method comprising: receiving a suspicious file in a host computer, said suspicious file suspected of being malware; before receiving said suspicious file, saving volatile memory of said host computer in a first file of mass storage of said host computer; before receiving said suspicious file, saving bootstrapping components of said host computer into a second file of said mass storage, said bootstrapping components including information necessary to bootstrap and run said host computer, said second file of said mass storage being inaccessible to said suspicious file; executing said suspicious file directly on a CPU of said host computer, said suspicious file not being executed within a virtual machine; detecting malicious behavior of said executing suspicious file; recording said malicious behavior during said execution of said suspicious file; and generating a report using said recorded malicious behavior, said report indicating that said suspicious file is a particular type of malware.