Systems and methods for managing multiple related pestware processes on a
protected computer are described. One embodiment is configured to
identify a location of each of a plurality of files in at least one file
storage device of the protected computer and store a list of the location
of each of the plurality of files. The list of the plurality of files is
then sorted so as to generate a sorted list. Each of the plurality of
files is then sequentially accessed as listed in the sorted list so as to
retrieve information from each of the plurality of files. Information
from the plurality of files is then analyzed to determine whether any of
the plurality of files are potential pestware files. In variations, the
files in the file storage device are enumerated, and information from the
files is accessed, by circumventing the operating system of the protected
computer.