A malware detection and defusing system comprising: at least one server side computer; and at least one client side computer; wherein: at least one malware sample is processed in at least one server side computer by intercepting all of the malware's system calls at the kernel level; at least one signature is formed for each malware sample by a server side computer having at least one stop call at or prior to a fixing moment; the signature is distributed by the server side computer to at least one client side computer, wherein: a driver hooks all of the system calls at the kernel level of the operating system of the client side computer in real time, without the use of emulation; the systems calls are processed by a filter to remove system calls deemed not to be associated with malware; the information about the system calls not removed by the filter is accumulated on a per-thread basis and checked for a stop call; a detector compares the information about the system calls contained in the thread associated with the stop call to the signature for a match with malware prior to the fixing moment; and the thread that is matched with malware is defused at the fixing moment. at least one server side computer; and at least one client side computer; wherein: at least one malware sample is processed in at least one server side computer by intercepting all of the malware's system calls at the kernel level; at least one signature is formed for each malware sample by a server side computer having at least one stop call at or prior to a fixing moment; the signature is distributed by the server side computer to at least one client side computer, wherein: a driver hooks all of the system calls at the kernel level of the operating system of the client side computer in real time, without the use of emulation; the systems calls are processed by a filter to remove system calls deemed not to be associated with malware; the information about the system calls not removed by the filter is accumulated on a per-thread basis and checked for a stop call; a detector compares the information about the system calls contained in the thread associated with the stop call to the signature for a match with malware prior to the fixing moment; and the thread that is matched with malware is defused at the fixing moment. at least one malware sample is processed in at least one server side computer by intercepting all of the malware's system calls at the kernel level; at least one signature is formed for each malware sample by a server side computer having at least one stop call at or prior to a fixing moment; the signature is distributed by the server side computer to at least one client side computer, wherein: a driver hooks all of the system calls at the kernel level of the operating system of the client side computer in real time, without the use of emulation; the systems calls are processed by a filter to remove system calls deemed not to be associated with malware; the information about the system calls not removed by the filter is accumulated on a per-thread basis and checked for a stop call; a detector compares the information about the system calls contained in the thread associated with the stop call to the signature for a match with malware prior to the fixing moment; and the thread that is matched with malware is defused at the fixing moment. a driver hooks all of the system calls at the kernel level of the operating system of the client side computer in real time, without the use of emulation; the systems calls are processed by a filter to remove system calls deemed not to be associated with malware; the information about the system calls not removed by the filter is accumulated on a per-thread basis and checked for a stop call; a detector compares the information about the system calls contained in the thread associated with the stop call to the signature for a match with malware prior to the fixing moment; and the thread that is matched with malware is defused at the fixing moment.