1. A method comprising: placing on a system a component extracted from a malware infection, without thereby infecting the system, in that the placed component does not behave maliciously in isolation from at least one other component of the malware infection which is not on the system; using a utility to obtain a listing which, in the absence of filtering by malware, would list the placed malware component; and checking the listing to determine whether the placed malware component is listed therein.