 It then analyzes the commands as they are performed, monitoring for common viral activities such as replication, file overwrites, and attempts to hide the existence of the suspicious file.If one or more virus-like actions are detected, the suspicious file is flagged as a potential virus, and the user alerted.Another common method of heuristic analysis is for the anti-virus program to decompile the suspicious program, then analyze the machine code contained within.