10. The method of claim 9 , further comprising: analyzing a file that has been modified to determine if an original classification associated with the file should be changed.
10. The method of claim 9 , further comprising: analyzing a file that has been modified to determine if an original classification associated with the file should be changed. 11. The method of claim 10 , wherein analyzing a file that has been modified comprises applying a screen configured to determine if the file, when executed, produces a behavior indicative of a threat.