1. A computer program product for controlling a computer to detect a computer program containing malware, said computer program product comprising: search code operable to search said computer program for external call instructions; comparison code operable to compare said external call instructions within said computer program with at least one predetermined external call instruction characteristic determined from a plurality of external calls and corresponding to known malware; and identification code operable to identify said computer program as containing malware if said external call instructions within said computer program match a predetermined external call instruction characteristic corresponding to known malware.