1. A method for determining that a computer program, targeted for execution in a real computer with a first operating system, is malicious, the method comprising the steps of: a virtual PC of the real computer virtually executing the target program, the virtual PC having a second, virtual operating system that controls execution of the target program in the virtual PC, the virtual operating system simulating functionality of operating system data areas and an operating system application program interface for the virtually executing target program, virtual execution of the target program within the virtual PC generating flags representing respective functions performed by the target program; the virtual PC tracking the flags to determine the functions performed by the target program and a sequence in which the functions are called by the target program during the virtual execution; and upon completion of the virtual execution of the target program, the virtual PC determining that the target program is malicious based on the tracked functions performed by the target program and the sequence in which the functions are called by the target program.