1. A computer-implemented method for optimization of anti-virus (AV) processing, the method comprising: (a) creating a database of malware detection rules and a database of correction coefficients on an AV server, wherein the detection rules include test rules; (b) updating a user-side database of malware detection rules and a user-side database of correction coefficients with current data from the database of malware detection rules and the database of correction coefficients on the AV server; (c) receiving, from users running user processes, at the AV server, data related to the user processes, if the process aggregate rating exceeds a safety threshold but is below a danger threshold; (d) accumulating received data related to the user process on an AV server data storage; (e) analyzing false-negative determinations; and (f) generating a database of correction coefficients for correction of the detection rules on the AV server based on the aggregate false-negative determinations.