1. A method for protecting against malware using heuristic analysis, the method being performed on a computer having a processor and a memory, the method comprising performing the following: (a) creating a set of static behavioral rules; (b) launching an executable component on the computer; (c) detecting an attempt to launch a process from a file by the executable component; (d) comparing the attempt against the static behavioral rules and allowing the attempt if the action does not match the rules; (e) if the attempt matches at least one rule, generating a reaction directive; (f) executing the reaction according to the directive; (g) based on the attempt, generating a rule directive for additional dynamic rules; (h) acquiring the dynamic rules corresponding to the rule directive and nesting the dynamic rules within the static rules, wherein the dynamic rules are a subset of the static rules that are inactive, and are introduced into a security system and are activated and nested within the static rules upon an occurrence of the attempt when an individual attempt is not malicious but a sequence of events is malicious, and wherein the dynamic rules have a finite lifetime and are enforced only during the finite lifetime, and wherein parameters of the dynamic rules depend on execution of the static rules; and (i) repeating steps (d)-(h) for subsequent attempts, wherein steps (a) through (i) are performed on the computer.
1. A method for protecting against malware using heuristic analysis, the method being performed on a computer having a processor and a memory, the method comprising performing the following: (a) creating a set of static behavioral rules; (b) launching an executable component on the computer; (c) detecting an attempt to launch a process from a file by the executable component; (d) comparing the attempt against the static behavioral rules and allowing the attempt if the action does not match the rules; (e) if the attempt matches at least one rule, generating a reaction directive; (f) executing the reaction according to the directive; (g) based on the attempt, generating a rule directive for additional dynamic rules; (h) acquiring the dynamic rules corresponding to the rule directive and nesting the dynamic rules within the static rules, wherein the dynamic rules are a subset of the static rules that are inactive, and are introduced into a security system and are activated and nested within the static rules upon an occurrence of the attempt when an individual attempt is not malicious but a sequence of events is malicious, and wherein the dynamic rules have a finite lifetime and are enforced only during the finite lifetime, and wherein parameters of the dynamic rules depend on execution of the static rules; and (i) repeating steps (d)-(h) for subsequent attempts, wherein steps (a) through (i) are performed on the computer. 12. The method of claim 1 , wherein each individual attempt is harmless and a sequence of attempts is malicious.