A method for asynchronous processing of system events on a computer system, the method comprising: (a) detecting a system event on the computer system and intercepting the system event for filtering, wherein the system event comprises a system call; (b) filtering the system event through at least one filter to determine if the system event matches a security criteria; (c) if the system event does not pass through at least one filter, sending the system event for further processing; and if the system event passes through the at least one filter, creating a copy of the system event which is passed through the at least one filter for asynchronous anti-virus processing the copy of the system event, and releasing the original system event so that the process which caused the event continues its uninterrupted execution; (d) placing the copy of the system event into a queue for asynchronous anti-virus processing; (e) creating a control record based on the event copy by using information about the event; (f) deleting the copy of the system event from the queue; (g) performing asynchronous anti-virus processing on the control record of the system event, wherein the asynchronous anti-virus processing of the control record comprises a signature scanning of the control record of the system event and analyzing the process that caused the system event by executing the process in an emulator and by generating a behavior log for the process and terminating the process that caused the system event, if the anti-virus processing reveals a malicious nature of the system event; and (h) for a process that has behavior differences compared to a previous known non-malicious version of the process but also substantial similarities to the previous known non-malicious process, classifying the process as non-malicious. (a) detecting a system event on the computer system and intercepting the system event for filtering, wherein the system event comprises a system call; (b) filtering the system event through at least one filter to determine if the system event matches a security criteria; (c) if the system event does not pass through at least one filter, sending the system event for further processing; and if the system event passes through the at least one filter, creating a copy of the system event which is passed through the at least one filter for asynchronous anti-virus processing the copy of the system event, and releasing the original system event so that the process which caused the event continues its uninterrupted execution; (d) placing the copy of the system event into a queue for asynchronous anti-virus processing; (e) creating a control record based on the event copy by using information about the event; (f) deleting the copy of the system event from the queue; (g) performing asynchronous anti-virus processing on the control record of the system event, wherein the asynchronous anti-virus processing of the control record comprises a signature scanning of the control record of the system event and analyzing the process that caused the system event by executing the process in an emulator and by generating a behavior log for the process and terminating the process that caused the system event, if the anti-virus processing reveals a malicious nature of the system event; and (h) for a process that has behavior differences compared to a previous known non-malicious version of the process but also substantial similarities to the previous known non-malicious process, classifying the process as non-malicious.