13. A system for protecting against malware, the system comprising: a driver installed on a computer system having a processor and a memory, for intercepting actions performed by components executed on the computer system; a service engine having a plurality of static rules coupled to the driver; a service database accessible by the service engine; and a management server connected to the service database, wherein: the management server generates a plurality of static rules and provides them to the service database; the driver detects actions performed by a component executing on the computer system and provides the actions for analysis to the service engine, wherein the actions include an attempt to launch a process from a file, and wherein: the service engine compares actions against static and currently instantiated dynamic rules and based on comparison acquires some dynamic rules from the database; and the dynamic rules are nested with the static rules and applied to the subsequent actions executed on the computer system, wherein the dynamic rules are a subset of the static rules that are inactive, and are introduced into the system and are activated and nested within the static rules upon an occurrence of the action when an individual action is not malicious but a sequence of events is malicious, wherein parameters of the dynamic rules depend on execution of the static rules, and wherein the dynamic rules have a finite lifetime and are enforced only during the finite lifetime.
13. A system for protecting against malware, the system comprising: a driver installed on a computer system having a processor and a memory, for intercepting actions performed by components executed on the computer system; a service engine having a plurality of static rules coupled to the driver; a service database accessible by the service engine; and a management server connected to the service database, wherein: the management server generates a plurality of static rules and provides them to the service database; the driver detects actions performed by a component executing on the computer system and provides the actions for analysis to the service engine, wherein the actions include an attempt to launch a process from a file, and wherein: the service engine compares actions against static and currently instantiated dynamic rules and based on comparison acquires some dynamic rules from the database; and the dynamic rules are nested with the static rules and applied to the subsequent actions executed on the computer system, wherein the dynamic rules are a subset of the static rules that are inactive, and are introduced into the system and are activated and nested within the static rules upon an occurrence of the action when an individual action is not malicious but a sequence of events is malicious, wherein parameters of the dynamic rules depend on execution of the static rules, and wherein the dynamic rules have a finite lifetime and are enforced only during the finite lifetime. 14. The system of claim 13 , wherein the static rules are instantiated at startup of the computer system.