1. A method to determine if a computer program in a memory of a computer is malicious, the computer program including a plurality of different types of computer program instructions, the method comprising the steps of: prior to execution of the computer program in the computer, the computer counting the computer program instructions of each of the types; at a time during execution of the computer program in the computer, the computer counting the computer program instructions of each of the types; and the computer determining that the count of the computer program instructions of one of the types determined prior to execution of the computer program differs by at least an associated threshold value from the count of the computer program instructions of the one type determined at the time during execution of the computer program, and in response, the computer making a record that the computer program has an indicia of maliciousness.