1. A system for detecting malicious programs, the system comprising: a processing system having at least one processor configurable to emulate execution of a program code; monitor events of program execution; classify the monitored events as malicious or non-malicious; collect information about unclassifiable events; and an analyst workstation connected to the processing system, the workstation including means for isolating a program analyst from external audiovisual stimuli; a video output device operable to display a list of unclassifiable events and event-related information to the program analyst; and a user input device operable to receive analyst's physiological response indicative of whether the displayed list of unclassifiable events exhibits malicious behavior.