8. A process for use by an analyst assisted by a computational machine to identify software program code as a malware detection signature generation candidate, the software program configured to run on a virtual machine, the process comprising the steps of: utilizing at least one processor and a memory to run the program code on the virtual machine, the virtual machine changing states while the program code is running; making a determination, from at least one result which corresponds to at least one state of the virtual machine while running the program code, that the program code should be investigated as a possible carrier of malware; associating an identification start state in memory with the determination; causing the computational machine to place in a set of variables of interest in a memory of the computational machine at least one variable which is visible in the identification start state, namely, a variable which is within scope and could be assigned a value; the computational machine also being caused to search previously executed states of the virtual machine (states prior to the identification start state) for any assignment of a variable that belongs to the set of variables of interest; the computational machine also being caused to put into a set of assignments of interest in the memory an assignment that was found by the searching step; when the set of assignments of interest contains a nonterminated assignment having at least one source parameter variable, the computational machine also being caused to place the source parameter variable(s) of that nonterminated assignment in the set of variables of interest and then repeat the searching and putting steps; when the set of assignments of interest does not contain a nonterminated assignment having at least one source parameter variable, the computational machine also being caused to produce an identification of a region of code as the malware detection signature generation candidate, the region of code defined by the set of assignments of interest; and receiving the malware detection signature generation candidate identification which was produced by the computational machine.
8. A process for use by an analyst assisted by a computational machine to identify software program code as a malware detection signature generation candidate, the software program configured to run on a virtual machine, the process comprising the steps of: utilizing at least one processor and a memory to run the program code on the virtual machine, the virtual machine changing states while the program code is running; making a determination, from at least one result which corresponds to at least one state of the virtual machine while running the program code, that the program code should be investigated as a possible carrier of malware; associating an identification start state in memory with the determination; causing the computational machine to place in a set of variables of interest in a memory of the computational machine at least one variable which is visible in the identification start state, namely, a variable which is within scope and could be assigned a value; the computational machine also being caused to search previously executed states of the virtual machine (states prior to the identification start state) for any assignment of a variable that belongs to the set of variables of interest; the computational machine also being caused to put into a set of assignments of interest in the memory an assignment that was found by the searching step; when the set of assignments of interest contains a nonterminated assignment having at least one source parameter variable, the computational machine also being caused to place the source parameter variable(s) of that nonterminated assignment in the set of variables of interest and then repeat the searching and putting steps; when the set of assignments of interest does not contain a nonterminated assignment having at least one source parameter variable, the computational machine also being caused to produce an identification of a region of code as the malware detection signature generation candidate, the region of code defined by the set of assignments of interest; and receiving the malware detection signature generation candidate identification which was produced by the computational machine. 10. The process of claim 8 , wherein the method further comprises causing an addition of instrumentation code which logs scopes in an abstract syntax data structure as code of the software program is generated during a compilation.