Computer security system and method

A method for protecting a computer system, comprising:

• attaching a security descriptor to a process running on a processor of the computer system that has been previously started;
• associating with the security descriptor an isolation indicator that, by itself, indicates the process is to run in an isolation mode, thereby rendering it as an isolated process, the isolated process running with non-isolated processes in a common environment;
• calling a kernel routine by the isolated process that is also callable by a process that is not running in isolation mode;
• attempting to write to an object of a disk or a registry by the kernel routine called by the isolated process;
• determining, by a filter driver running in kernel mode, whether the kernel routine is requesting the write on behalf of the isolated process or a non-isolated process;
• if the write is requested on behalf of the isolated process, then performing the write in a pseudo storage area;
• and
• if the write is requested on behalf of the non-isolated process, then performing the write in an actual storage area in which the disk, registry, or other actual system or process data resides;
• wherein if the requested write is a first object write, then copying the object from the actual storage area to the pseudo storage area.