The invention provides a method of disabling malicious or unwanted software on a computer system using a plurality of rules, wherein the plurality of rules automatically disable functions originating from malicious software. In one embodiment, the method includes detecting a function that is attempting to act on an object within the computer system and identifying one or more rules from the plurality of rules that apply to the object. The function may then be automatically disabled when the identified rules indicate that the function should be disabled.