Features:
» Monitors process, file and registry activity for suspicious behavior
» Detects all forms of malware, whether known or unknown
» Supports learning mode and silent mode
» High performance and low resource usage
» Detects hidden processes and threads
» Detects unsigned processes and modules
» Kills processes and threads using advanced method
» Suspends/resumes processes and threads
» Unloads modules of processes
» Closes handles of processes
» Detects hidden kernel modules and kernel threads
» Detects unsigned kernel modules
» Kills, suspends and resumes kernel threads
» Kills kernel DPC (Deferred Procedure Call) timers
» Detects and removes system service table hooks (SSDT hooks)
» Detects and removes Win32k service table hooks (shadow SSDT hooks)
» Detects and removes interrupt descriptor table hooks (IDT hooks)
» Detects and removes SYSENTER handler hook
» Detects and removes kernel object hooks
» Detects and removes kernel notify routines
» Detects and removes kernel mode code hooks
» Detects and removes user mode code hooks
» Detects and removes global message hooks
» Detects attached devices
» Detects hooked driver dispatch routines (IRP hooks)
» Scans all known autostart locations
» Detects hidden autostart entries
» Detects newly added autostart entries
» Undoes and redoes deletion of autostart entries
» Detects hidden files and folders
» Shows and deletes NTFS Alternate Data Streams (ADS)
» Deletes in-use files
» Full functional registry editor
» Detects hidden registry entries