The basic idea is that if the user could know a new program silently installed into memory, appropriate countermeasures can be taken.

After a learning period, the program detects new processes running into memory alerting the user. The on-line status is also detected,asking then the user if an automatic termination of any unknown processes is desired (this option can be also enabled by default). This leads to an active protection against trojan\spyware-infected e-mail attachments.

Finally the program can also scan ports, displaying the open ports \IP addresses and processes owning open ports.