it has two parts: vdetector and vmonitor how does it work: vdetector creates file information database of files with extensions default (exe;dll;com;ocx;vbs;vtx;xml;xsl;vsc) from windows directory and from other directories in your computer that you choose manually and it detects: - file size changes - new files - deleted files it also detects registry changes: - new values - deleted values in windows startup keys and from other keys that you choose manually. when suspicious file was detected program has very powerfull functions and tools for their termination and for damage prevention that thouse files could cause. it also detects internet and network connection, traffic, and all addresses that you visit. vmonitor is active process that detects all changes and it momentary warn you for all: - file size changes - new files - deleted files it also detects registry changes: - new values - deleted values all directories must be defined in file information database before detection.