SurfRight has done an extensive research of malware files to determine the common characteristics (behaviour) of malware. The HitmanPro client uses this research in its Behavioural Scan, when it scans the computer for virus activities or suspicous files that have the characteristics of malware.
For the files that are classified as suspicious, the Hitman Pro client sends a request to the Scan Cloud for confirmation if these files are indeed malicious. The Scan Cloud is a cluster of multiple computers, residing on the Internet. The Scan Cloud will respond to this request with the answer: * Safe * Malicious * Unknown
When the file is unknown, the Hitman Pro client uploads the file to the Scan Cloud where the file is scanned using the anti virus programs of 5 different vendors. Each of these anti virus programs analyzes the file and responds with “safe” or “malicious”.
When the file is classified as malicious by the Scan Cloud, the Hitman Pro client is placing the infection into quarantine. Various techniques ensure that all infections are completely removed without false positives.
To remove malicious software the developers have also built a special removal engine that is capable of removing the toughest threats. A native NT application is capable of removing resilient threats before Windows starts. And of course, including corresponding references like registry keys and shortcuts. All without the need of updates and signatures.