1. A method of detecting malware on a computer system, the method comprising: receiving at the computer system, from a central server, a list of trusted applications and respective sets of unexpected behaviours; identifying certain trusted applications from the list running on the computer system, which are at risk of being hijacked by malware; monitoring the behaviour of the identified trusted applications and, in an event that one or more unexpected behaviours of the identified trusted application is detected, identifying a file or files which is or are responsible for the unexpected behaviour and which has or have hijacked that trusted application.