A simple test to see is a host infected with earlier versions of "SpyEye" malware, which dropped a file at the same location every time. Good "proof of concept" showing that malware can be easily detected based on predictable behavior. later versions of SpyEye randomly chose their "drop file" location.
47fe222c307b38e17f5980aac2311b07cad91512447c0c7ebe7f8c9f9001844a