1. A method of collecting behaviors of a suspicious file, said method comprising: receiving said suspicious file on a host computer, said suspicious file including executable code and suspected of being malicious, and wherein said suspicious file is a file in portable executable format; analyzing said executable code before execution and identifying a packing program that has packed said executable code, and wherein said executable code has been compressed or encrypted by said packing program; disabling a software hook in an emulator of said host computer based upon said identified packing program; executing said suspicious file within said emulator of said host computer after said disabling; and collecting behaviors of said suspicious file while said suspicious file is executing within said emulator, said executing suspicious file not prematurely terminating by virtue of not detecting use of said software hook in said emulator.