1. A method of detecting polymorphic viral code in a computer program, comprising the steps of: (a) emulating a first predetermined number of instructions of the computer program; (b) collecting information corresponding to a state of a plurality of registers and/or flags after each emulated instruction execution; and (c) determining a probability that the computer program contains polymorphic viral code based on an heuristic analysis of the collected register/flag state information.