• ThreatSense™ technology — a single optimized anti-threat engine for analyzing code to identify malicious behavior such as viruses, spyware, adware, phishing, and more.
• Unprecedented heuristic analysis capable of discovering new malware threats as they emerge.
• Powerful virtual PC emulation technology enables unpacking and decryption of all types of archives and run-time packing.
• User-friendly installation and simple configuration.
• Does not require external libraries or programs except for libc.
• Flexible six-level infiltration and activity logging.
• Uses both the on-demand and on-access scanning techniques to secure and protect the entire file system and running processes.
• Provide file access control over Samba, Nettalk and NFS.

System architecture
NOD32 for LFS consists of on-demand and on-access scanning modules. The on-demand scanner performs scanning of the selected file system upon user request via command line. Using standard Linux operating system schedulers, various periodic scanning tasks can be pre-defined. The on-access scanner daemon provides real-time monitoring of the entire file system. File scanning is triggered by user or system events that result in file access calls by the Linux kernel. The file infomation is passed on to the NOD32 scanning engine. Depending on the scanning results a predefined action on the file is triggered. File access can be allowed or denied and the appropriate log output is created.