AVZ Antiviral Toolkit is a free antivirus. In addition to a standard scanner, heuristic analysis, and auditor, the program has tools for automatically removing malicious code, allowing an experienced user to expand control over their PC system.
The program detects and blocks:
- Trojan software
- Backdoors
- Spyware and Adware
- Viruses
- Email worms
- Network worms
- Keyloggers
- Rootkits
AVZ is also used to create logs, which are useful on antivirus forums when requesting help.
Main functionality of AVZ
- Heuristic scan. Detection of viruses and spyware based on signatures on the disk and in memory.
- Constantly updated databases. The database is included in all AVZ systems and operates using the "trusted/untrusted" method.
- Rootkit detector. The search is performed without signatures, based on examining system base libraries for function interception. After detection, rootkits are blocked.
- Detectors for Trojan DLLs and keyboard spyware. Their detection is performed without using signature databases, based on analysis, detecting unknown threats like Trojan DLLs and keyloggers; false positives are possible.
- Neuroanalyzer. In addition to the signature analyzer, AVZ has a neuroemulator for examining suspicious files using a neural network. Currently, the neural network is used in the keylogger detector.
- Winsock SPI/LSP. The settings analyzer examines configurations, diagnoses errors, and automatically repairs them. Automatic diagnostics and repair are very useful for novice users. AVZ has a special manual settings manager. An anti-rootkit is used during analysis.
- Driver, service, and process manager. The process manager is linked to the program's database of safe files; certain identified system safe files are highlighted in color.
- Utility for finding files on disks. The capability of this search is much higher than the system search. An anti-rootkit is used during the search. The filter excludes files recognized as safe by AVZ from the search results. The result is available in tables and a text log.
- Utility for finding data in the registry. Provides search for keys and values by pattern; the search result is available in tables and a text log. An anti-rootkit is used during the search.
- TCP/UDP open port analyzer. The anti-rootkit's operation applies to the analyzer. The analyzer uses updatable databases of ports for Trojan/Backdoor programs and known system services. The search is part of the main algorithm — after identifying suspicious ports, the program outputs warnings to the logs.
- Analyzer of network sessions, shared resources, and files opened over the network. Works on Windows 9x, NT/2k/XP.
- DPF (Downloaded Program Files). The analyzer reflects DPF components and is included in all AVZ systems.
- System restore. Restores damaged Internet Explorer settings, program launch parameters, and other system parameters. Restoration is initiated manually.
- Heuristic file removal. The essence of this option is the automatic examination of the PC system. All identified references to removed files are automatically cleaned up and logged. The PC system treatment engine is actively used for such cleaning.
- Archive scanning. Currently scans archives in gzip, tar; ZIP, CAB, RAR, email formats; CHM archives; MHT files.
- Scanning and treatment of NTFS streams.
- Script management. Scripts enable the program's use in corporate networks, including launching at PC system startup.
- Process analyzer. Used by analysis microprograms and the neural network, it operates during advanced analysis at higher heuristic levels and serves to identify suspicious processes in memory.
- AVZGuard. A system for combating difficult-to-remove malicious programs; besides AVZ, it protects user-defined applications, for example, other antivirus and anti-spyware programs.
- Direct disk access when working with locked files. The system works on FAT16/FAT32/NTFS, on all NT line OSes, allowing the scanner to analyze locked files and move them to quarantine.
- Process monitoring and AVZPM drivers. Used to monitor the start and stop of processes, unloading/loading of drivers to detect masquerading drivers, and distortions in process and driver descriptions created by DKOM rootkits.
- Boot Cleaner. A driver used to clean the PC system (removing registry keys, services, drivers, files) from KernelMode. Cleaning is performed during PC reboot and during its treatment.
