1. A method for detecting malicious programs, the method comprising: determining whether an object is suspicious; opening, in response to determining that the object is suspicious, the suspicious object in a disposable, secure, single purpose virtual machine (VM) session running on a computer system; and detecting indications of malicious behavior when the suspicious object is opened within the VM session, the detecting of the indications of the malicious behavior comprising: taking a first snapshot of one or more system features of the VM session prior to opening the object in the VM session; taking a second snapshot of the one or more system features of the VM session after the opening of the object in the VM session; and comparing the first snapshot with the second snapshot to detect indications of the malicious programs within the VM session.