1. A computerized method of reverting system data effected by a malware, comprising: monitoring, in run time, a plurality of events of a plurality of processes executed by an operating system (OS) running on a computing device: logging in an event log, in run time, said plurality of events; classifying, in run time, a first process of said plurality of processes as a malware; identifying a set of events of said first process from said plurality of events using said event log; and identifying at least one system object of said OS which is hosted in said computing device and affected by said set of events; matching between a signature of said at least one system object and a plurality of signatures of a plurality of system object templates to identify at least one matching system object template of an OS update version suitable to said at least one system object; and using said at least one system object template for removing, in response to said classification, an effect of said malware which is caused by said set of events to said at least one system object; wherein said removing comprises deleting or modifying a registry value added by said first process; wherein said plurality of events comprises a plurality of write commands.