Keep in mind that any Inits in the system file will load into memory as well, so check carefully for any weird ones. Scores changes common system files to Inits so watch for this as well.
As far as detection goes, check the modification dates and sizes on used applications. Applications usually don't grow or get modified, so a lot of them with recent dates is a bad sign. The system file usually will not grow, but it is modified by several common actions (such as choosing a new printer) so checking the date on the system file is not useful.