1. A method to determine if a computer program in a memory of a computer is malicious, the computer program including computer program instructions, the method comprising the steps of: the computer identifying, for a set of instructions from the computer program, a set of addresses in the memory, the set of addresses corresponding to respective instruction locations for the set of instructions, the corresponding of the addresses to the respective instruction locations occurring at a time that the computer program is loaded into the memory; during execution of the computer program, and in response to executing an interrupt generating program instruction, the interrupt generating program instruction being a subset of the set of instructions, the computer identifying changes to the set of instructions by comparing the set of addresses to current address locations for instructions of the computer program, wherein the identifying changes occurs before an interrupt handler triggered by the interrupt generating program instruction executes a normal process of the interrupt handler dictated by the computer program instructions, and in response to identifying changes to the set of instructions, the computer indicating that the computer program has an indicia of maliciousness.