Patent ID: 8181247

Claim:
A computer-implemented method for malware protection of a computer, the method comprising: monitoring events of execution of one or more processes on the computer; identifying auditable events among the monitored events, wherein the auditable events include at least events of creation, alteration or deletion of files, events of creation, alteration or deletion of parameters or values of system registry, and network connection events by one or more software objects on the computer; recording the identified auditable events in separate file, registry and network event logs; performing a malware check of one or more software objects on the computer; if an object is determined to be malicious, identifying from the file and registry event logs one or more file events and registry events associated with said malicious object; performing rollback of one or more identified file events and registry events; identifying from the network log one or more network connections associated with parent processes, children processes or threads of execution of said malicious object; and terminating one or more of the identified network connections.