1. A method of detecting a malicious program on a computer system, the method comprising: shimming into a running process of the system to create at least one monitoring hook to monitor a program; building at least one execution path of the monitored program; and monitoring a behavior of the at least one execution path for malicious behavior using the monitoring hook.