1. A method, comprising: while a program is running on an information handling system in a manner that permits the program to infect the information handling system, the information handling system calculating a first score and a second score, wherein the first score is indicative of the likelihood that the program is malicious, wherein the second score is indicative of the likelihood that the program is valid, and wherein the calculating includes running a detection routine that performs a call to an application programming interface (API) of an operating system of the information handling system to gather information about the program, wherein the first score is calculated based on weighted results of those ones of a first plurality of detection routines that indicate a likelihood that the program is malicious, and wherein the second score is calculated based on weighted results of those ones of a second plurality of detection routines that indicate a likelihood that the program is valid; and the information handling system categorizing the program with respect to the likelihood of the program infecting the information handling system, wherein the categorizing includes categorizing the program as valid code based on the second score being above a threshold value, regardless of the first score.