1. A method for scanning executable memory of a protected computer for pestware comprising: enumerating a process and at least one dependency related to the process, wherein the process and the at least one dependency are running in the executable memory; identifying a reference point in the executable memory for the process and at least one other reference point in the executable memory for the at least one dependency; and scanning at least one portion of memory that is located at an offset from the at least one other reference point in the executable memory so as to identify whether code indicative of a pestware process resides in the executable memory at the least one portion of memory.