Realtime protection system
Monitors process, file and registry activity for suspicious behavior.
Monitors network activity.
Detects all forms of malware, whether known or unknown.
Supports learning mode and silent mode.
High performance and low resource usage.
Process manager
Detects hidden processes and threads.
Detects unsigned processes and modules.
Kills processes and threads using advanced method.
Suspends/resumes processes and threads.
Unloads modules of processes.
Closes handles of processes.
Kernel module manager
Detects hidden kernel modules and kernel threads.
Detects unsigned kernel modules.
Kills, suspends and resumes kernel threads.
Kills kernel DPC (Deferred Procedure Call) timers.
Hooks detector
Detects and removes system service table hooks (SSDT hooks).
Detects and removes Win32k service table hooks (shadow SSDT hooks).
Detects and removes interrupt descriptor table hooks (IDT hooks).
Detects and removes SYSENTER handler hook.
Detects and removes kernel object hooks.
Detects and removes kernel notify routines.
Detects and removes kernel mode code hooks.
Detects and removes user mode code hooks.
Detects and removes global message hooks.
Detects attached devices.
Detects hooked driver dispatch routines (IRP hooks).
Autostart application manager
Scans all known autostart locations.
Detects hidden autostart entries.
Detects newly added autostart entries.
Undoes and redoes deletion of autostart entries.
File explorer
Detects hidden files and folders.
Shows and deletes NTFS Alternate Data Streams (ADS).
Deletes in-use files.
Registry editor
Full functional registry editor.
Detects hidden registry entries.