A method is disclosed, where some embodiments of the method include installing at least one benign malware indicator on one or more computing devices, monitoring the one or more computing devices for the presence of the at least one benign malware indicator, and responsive to determining the benign malware indicator is no longer present, sending a notification indicating the benign malware indicator is no longer detected as present on the one or more computing devices. Other embodiments include performing an antivirus scan or identifying unauthorized software programs. An apparatus and one or more non-transitory computer-readable media storing computer-readable instructions capable of performing similar actions, the latter in conjunction with a computer executing instructions stored on the media, are also disclosed.