1. A method for analyzing a program executing within a virtual environment on a computing device, comprising: determining whether the program is attempting to detect whether it is being executed within the virtual environment; and analyzing the program within a protected mode of the computing device in response to determining that the program is attempting to detect whether the program is being executed within the virtual environment.