1. An antivirus protection system for computers, comprising: a Process Behavior-Evaluating Unit for identifying programs existing in a user's computer and classifying the programs as normal programs or suspect programs; a Program-Monitoring Unit for monitoring and recording actions and/or behaviors of the programs; a Correlation-Analyzing Unit for creating correlative trees and analyzing correlations of actions and/or behaviors of programs, the correlative trees comprising a process tree and a file tree, wherein each node in said process tree represents a process, and stores action and/or behavior information of the respective process during running and index information of the process in the file tree, and further each node has a parent node corresponding to the parent process of the process corresponding the node, and wherein, in the file tree, each node represents a program, and stores information when the program file is created and index information in the process tree, and further each node has a parent node corresponding to the parent process of the process corresponding the node; a Virus-Identifying Knowledge Base, comprising a Program-Behavior Knowledge Base and a Database of Attack-Identifying Rules, wherein the Program-Behavior Knowledge Base stores correlation behaviors of the normal programs and the Database of Attack-Identifying Rules stores correlation behaviors of the suspect programs; and a Virus-Identifying Unit for receiving program actions and/or behaviors captured by the Program-Monitoring Unit, when the program actions and/or behaviors are dangerous actions, calling the correlation-Analyzing Unit to create correlation behavior according to the process tree and the file tree, if the program is a normal program according to the Process Behavior-Evaluating Unit, comparing the captured actions and/or behaviors to information stored in the Program-Behavior Knowledge Base, and if the program is a suspect program, comparing the captured actions and/or behaviors to information stored in the Database of Attack-Identifying Rules to determine whether the program is a virus in dependence on the comparison.
5. The system of claim 1 , wherein the information stored in each node in the process tree comprises at least one of: a full path associated with a PE file, a full path of the process' loader, whether the process has a description, whether the process is self-starting, a creator of a self-starting process, properties associated with the process, whether the process is started by its creator, whether the process created any startup items, whether the process has an associated windows and/or tray icon, a pid number of the process's parent process, a linked list of modified system registry items, and a network action linked list.