1. A method for detecting malicious programs, the method comprising: determining whether an object is suspicious; opening the suspicious object in a disposable, secure, single purpose VM (virtual machine) session; and detecting indications of malicious behavior when the suspicious object is opened within the VM session.