1. A method of detecting a class of viral code, comprising: heuristically analyzing a subject file to generate a set of flags along with statistical information; using the set of flags with statistical information to perform at least one search for a scan string and/or a statement type in the subject file; and triggering a positive detection alarm if each of the at least one search is found at least a corresponding predetermined number of times.