1. A processing system supporting virtualization to run multiple independent virtual machines that do not interfere with each other comprising: a virtual machine monitor (VMM), to be executed on a processor of the processing system, to provide an abstraction of one or more virtual machines, and to identify and mark a file that is suspected of being malicious, a virtual machine control structure (VMCS) to store a state of guest software of the virtual machines, state of the VMM, and execution control information indicating how the VMM controls operation of guest software; a first application program running as guest software within a user virtual machine, to be executed on a processor of the processing system, wherein the first application program running within the user virtual machine is to request execution of or access to the suspected file; a second application program running as guest software within a sandbox virtual machine, to be executed on the processor of the processing system, the second application program being “forked” as a copy of the first application program, the sandbox virtual machine being a copy of the user virtual machine, wherein, in response to the first application program's request to execute or access the suspected file within the user virtual machine, the second application program running within the sandbox virtual machine to at least one of execute or access the suspected file, wherein the sandbox virtual machine's functionality is restricted by the VMM, thereby preventing damage caused by executing or accessing the suspected file outside of the sandbox virtual machine's execution environment; and a policy enforcer virtual machine to be executed on a processor of the processing system to identify and mark files that are suspect instead of the VMM identifying and marking the suspect files, and to enforce a sandbox policy defining allowable actions to be taken by the second application program running as guest software within the sandbox virtual machine during at least one of execution or accessing of the suspect file.