The management of virus definitions is separated from the other components of the program in order to maintain independence during updates. The addition, deletion and modification of virus definitions will be related to virus engines rather than virus load objects, so that the management of the engines and virus definitions are more flexible. (It is the virus definitions related to the virus engines that can be increased, deleted or modified, rather than load modules of virus definitions and other modules of engines.)

It is now unnecessary to completely replace the virus definitions during updates, making the process faster, safer, and with smaller downloads.

The engine component structure is setup so that it uses rational links, with better stability, compatibility, scalability and consistency.

The engine component is independent, making addition, deletion and modification more flexible. Delayed processing is applied to suppress error messages while removing the file, making virus processing cleaner.

Packed programs are unpacked, preloaded, and executed in a virtual machine, while called routines execute in native mode. This results in faster scanning and keeping the virtual machine processing speed in Windows and Linux consistent.

Engines run independently and call relevant sub-functions.

Backwards compatibility from Windows 95 and onwards:

Two modes, “Smart Monitor” and “Forced Virus Deletion” are added to File Monitor.

Smart Monitor: A user can choose to scan for viruses under one of three cases: file creation, modification, or execution. Scanning will occur automatically only when the case condition is met.  In the previous version of File Monitor, any behavior can trigger the scan. Smart Monitor dramatically improves working efficiency and reduces the usage of system resources.

Forced Virus Deletion: When a running virus cannot be deleted because the system is using the file infected by it, the previous solution was to restart the computer and then delete the virus. However many viruses cannot be removed in this way. After Forced Virus Deletion is enabled, the system is able to delete the running virus program without the need to restart, thus solving the problem.

Email Monitor: Allows the user to specify additional ports used for sending and receiving email.

Previously, all scans were completed by the main program (rav.exe). Now with the newly-added screensaver scan (ravssave.exe) and embedded scan (ravlite.exe), multiple scans can be done simultaneously rather than sequentially.