1. A system for detecting malicious software on a computer system, comprising: a computer-readable storage medium having computer executable program code recorded thereon comprising: a suspicious software module for detecting suspicious software on the computer system; a tracking module for identifying a set of files on the computer system associated with the suspicious software and adding to the set a file touched by a file already in the set; and a behavior monitoring module for monitoring the files in the set to determine whether the suspicious software is malicious.