Low-level work with files and the system registry
CESAM works with files and the system registry using the most low-level functions that lie closest to the system kernel (Native API). This enables the program to bypass most application-level rootkits that hide files and registry levels. The user, however, does not need to load a special driver for scanning. (protection from kernel-level rootkits is guaranteed by another technology – double scanning).


