A method for malware protection of a computer, the method comprising: monitoring events of execution of one or more processes on the computer; identifying auditable events among the monitored events, wherein the auditable events are stored in a periodically updatable auditable events database, which includes at least events of creation, alteration or deletion of files, events of creation, alteration or deletion of parameters and values of system registry, and events of network access by processes executed on the computer; recording the identified auditable events in separate file event logs, registry event logs and network event logs; identifying relationships between monitored parent and children processes and threads of execution spawned by said monitored processes; performing a malware check of one or more software objects (111, 112, 113) on the computer; if one of said one or more software objects (111, 112, 113) is determined to be malicious, identifying from the file event logs, registry event logs and network event logs one or more of file events, registry events and network events associated with the malicious object (112, 312) and with one or more related parent and children processes and threads of execution spawned by the malicious object (112, 312); identifying one or more modified system and non-system objects (311, 313) created, altered or deleted by the parent and children processes and threads of execution spawned by the malicious object (112, 312); blocking the malicious object (112, 312) and the modified non-system objects without blocking the modified system objects,identifying one or more network connections established by the parent and children processes and threads of execution spawned by said malicious object (112, 312); terminating one or more identified network connections associated with the malicious object (112, 312); restoring at least portions of the altered system and non-system objects (311, 313) or deleted system and non-system files from a trusted file backup; deleting all identified new non-system files created by the parent and children processes and threads of execution spawned by said malicious object (112, 312); performing rollback of one or more file events associated with the malicious object (112, 312); performing rollback of one or more registry events associated with the malicious object (112, 312). monitoring events of execution of one or more processes on the computer; identifying auditable events among the monitored events, wherein the auditable events are stored in a periodically updatable auditable events database, which includes at least events of creation, alteration or deletion of files, events of creation, alteration or deletion of parameters and values of system registry, and events of network access by processes executed on the computer; recording the identified auditable events in separate file event logs, registry event logs and network event logs; identifying relationships between monitored parent and children processes and threads of execution spawned by said monitored processes; performing a malware check of one or more software objects (111, 112, 113) on the computer; if one of said one or more software objects (111, 112, 113) is determined to be malicious, identifying from the file event logs, registry event logs and network event logs one or more of file events, registry events and network events associated with the malicious object (112, 312) and with one or more related parent and children processes and threads of execution spawned by the malicious object (112, 312); identifying one or more modified system and non-system objects (311, 313) created, altered or deleted by the parent and children processes and threads of execution spawned by the malicious object (112, 312); blocking the malicious object (112, 312) and the modified non-system objects without blocking the modified system objects,identifying one or more network connections established by the parent and children processes and threads of execution spawned by said malicious object (112, 312); terminating one or more identified network connections associated with the malicious object (112, 312); restoring at least portions of the altered system and non-system objects (311, 313) or deleted system and non-system files from a trusted file backup; deleting all identified new non-system files created by the parent and children processes and threads of execution spawned by said malicious object (112, 312); performing rollback of one or more file events associated with the malicious object (112, 312); performing rollback of one or more registry events associated with the malicious object (112, 312).