A computer-implemented method for detecting malicious program behavior, comprising: emulating at least a part of a computer system in an isolated computer environment; emulating execution of a computer program in the isolated computer environment, including emulating execution of a process of the computer program and one or more remote threads in a process of another computer program, whereby the one or more remote threads are initiated as a result of the emulated execution of the process of the computer program; detecting events being generated by the process of the computer program and the one or more remote threads as a result of the emulation, wherein each event comprises at least a system call and a system response to the call; determining, substantially in real time, whether each detected event is associated with malicious program behaviors; storing in a data structure an indication of events associated with the malicious program behaviors; comparing a totality of events stored in the data structure for the emulated process of the computer program in combination with the events generated from emulation of the one or more remote threads, with one or more event patterns associated with malicious program behaviors; and if, based on the comparison, the totality of the events stored in the data structure for the emulated process of the computer program in combination with the events generated from emulation of the one or more remote threads corresponds to any of the event patterns associated with the malicious program behaviors, taking at least one of the following actions: cleaning the emulated program, quarantining the emulated program, or removing the emulated program from the computer system. emulating at least a part of a computer system in an isolated computer environment; emulating execution of a computer program in the isolated computer environment, including emulating execution of a process of the computer program and one or more remote threads in a process of another computer program, whereby the one or more remote threads are initiated as a result of the emulated execution of the process of the computer program; detecting events being generated by the process of the computer program and the one or more remote threads as a result of the emulation, wherein each event comprises at least a system call and a system response to the call; determining, substantially in real time, whether each detected event is associated with malicious program behaviors; storing in a data structure an indication of events associated with the malicious program behaviors; comparing a totality of events stored in the data structure for the emulated process of the computer program in combination with the events generated from emulation of the one or more remote threads, with one or more event patterns associated with malicious program behaviors; and if, based on the comparison, the totality of the events stored in the data structure for the emulated process of the computer program in combination with the events generated from emulation of the one or more remote threads corresponds to any of the event patterns associated with the malicious program behaviors, taking at least one of the following actions: cleaning the emulated program, quarantining the emulated program, or removing the emulated program from the computer system. cleaning the emulated program, quarantining the emulated program, or removing the emulated program from the computer system.