1. A method for detecting malware on a computer system, comprising: evaluating a first file on the computer system against trust criteria to determine whether the first file is compatible with the trust criteria; responsive to the first file being incompatible with the trust criteria, assigning the first file to a package of one or more files; monitoring the first file assigned to the package to determine whether the first file touches a second file on the computer system, wherein the second file is assigned to the package responsive to the second file being touched by the first file assigned to the package; tracking collective behavior of the files assigned to the package; comparing the collective behavior tracked for the files assigned to the package to conditions of a malware heuristic, each condition of the malware heuristic contributing points to a total score responsive to the condition being satisfied by the collective behavior; calculating the total score based on the comparison; and determining whether to convict the package as malware based on the calculated total score.