1. In a computing device that includes a memory for storing information, a scan engine for identifying information indicative of malware, and a central processing unit that executes information loaded in memory on behalf of a process, a computer-implemented method of identifying malware from the information loaded in memory, comprising: (a) regulating the ability of the process to access the information; (b) tracking the state of the information loaded in memory; and (c) causing the scan engine to scan the information for malware.