1. A method for scanning executable memory of a protected computer for pestware comprising: enumerating a process and at least one dependency related to the process, wherein the process and the at least one dependency are running in the executable memory, and the at least one dependency includes encrypted code; identifying a reference point in the executable memory for the process and at least one other reference point in the executable memory for the at least one dependency; and scanning at least one portion of memory for unencrypted code spawned from the encrypted code, the unencrypted code located at an offset from the at least one other reference point in the executable memory so as to identify whether code indicative of a pestware process resides in the executable memory at the at least one portion of memory.