1. A method for determining whether a computer program, addressed to a first computer having a plurality of files different than the computer program, includes malware, the method comprising the steps of: a second computer receiving the computer program via a network; listing in a file in the second computer, without installing the plurality of files in the second computer, identities of the plurality of files in the first computer and respective creation dates or respective last edit dates for the respective plurality of files in the first computer; creating, for the computer program, a simulated operating environment in the second computer using the file having the listing of identities of the plurality of files in the first computer and the respective creation dates or respective last edit dates; executing the computer program in the second computer; and the second computer determining whether the computer program attempts to access or utilize the plurality of files in a manner indicative of malware, and if so, the second computer generating a first record that the computer program exhibits a characteristic of malware, and if not, the second computer generating a second record that the computer program does not exhibit a characteristic of malware.