Add a signature module to detect malware that execute copies of themselves but require an .exe extension to operate properly.  Koobface is one example.