A computer-implemented method for detecting one or more unwanted applications installed on a computing device, the method comprising: obtaining, via a processor of the computing device, information relating to a first application installed on the computing device; detecting a first file associated with the first application; identifying a second file installed on the computing device and related to the first file, wherein the first file and second file are related when at least two of the following conditions are true: the first and second files were created by a same application; the first and second files were loaded onto the computing device from a same network address; an interval of time between modifications of the first and second files is less than a selected threshold value; and the first and second files have identical or similar attributes or data, wherein the identical or similar attributes or data of the first and second files being determined by at least: identifying a set of characteristics shared by the first and second files; determining a N-dimensional vector for each of the set of characteristics; and determining a degree of similarity between the first and second files based at least on a scalar product of two N-dimensional vectors; identifying a second application installed on the computing device using at least one of the first and second files; determining a first frequency of use for the first application and a second frequency of use for the second application, wherein the first or the second frequency of use is indicated by a number of actions performed by the respective application in the computing device; representing the first frequency of use into a first feature vector and the second frequency of use into a second feature vector; and determining whether the first application is an unwanted application based on a comparison of the first feature vector of the first frequency of use and the second feature vector of the second frequency of use. obtaining, via a processor of the computing device, information relating to a first application installed on the computing device; detecting a first file associated with the first application; identifying a second file installed on the computing device and related to the first file, wherein the first file and second file are related when at least two of the following conditions are true: the first and second files were created by a same application; the first and second files were loaded onto the computing device from a same network address; an interval of time between modifications of the first and second files is less than a selected threshold value; and the first and second files have identical or similar attributes or data, wherein the identical or similar attributes or data of the first and second files being determined by at least: identifying a set of characteristics shared by the first and second files; determining a N-dimensional vector for each of the set of characteristics; and determining a degree of similarity between the first and second files based at least on a scalar product of two N-dimensional vectors; identifying a set of characteristics shared by the first and second files; determining a N-dimensional vector for each of the set of characteristics; and determining a degree of similarity between the first and second files based at least on a scalar product of two N-dimensional vectors; identifying a second application installed on the computing device using at least one of the first and second files; determining a first frequency of use for the first application and a second frequency of use for the second application, wherein the first or the second frequency of use is indicated by a number of actions performed by the respective application in the computing device; representing the first frequency of use into a first feature vector and the second frequency of use into a second feature vector; and determining whether the first application is an unwanted application based on a comparison of the first feature vector of the first frequency of use and the second feature vector of the second frequency of use.