1. A computer-program product comprising a non-transitory computer readable storage medium containing computer program code comprising: an executable file installer trust chain validation application for determining whether a creator of a created executable file in a local filesystem is a trusted installer, wherein said determining comprises: receiving an indication of suspicious behavior from a behavior blocking application resulting from execution of said created executable file; and checking whether said created executable file is a trusted file, wherein said checking comprises determining that said creator is unsigned and determining that a location of said unsigned creator within said local filesystem indicates that said unsigned creator should be trusted, wherein upon a determination that said creator is said trusted installer, said executable file installer trust chain validation application further defines said created executable file as a trusted file.