1. A method of detecting a computer virus that attempts to gain access to restricted computer system resources, comprising: emulating computer executable code in a subject file; and monitoring the emulation of the computer executable code and monitoring a memory state of the computer system for modifications caused by the emulated instructions in the computer executable code, to detect an attempt by the emulated code to access one or more of the restricted computer system resources.