Products - VFind™ Security Toolkit Family

VSTK Standard

The VFind™ Security ToolKit (VSTK) is a suite of four powerful network and computer anti-virus utilities that provides flexible and uncompromising computer anti-virus protection. The VFind™ Security Toolkit contains:

VFind™, the first ever UNIX anti-virus scanner, with a unique heterogeneous design that allows for complete protection, in today's multi-platform networks. All VFindth Security Toolkit products feature a Cryptographic Integrity Tool (CIT), Universal Atomic Disintegration (UAD) and MVFilter.

CIT is a fantastic anti-virus security tool that has multiple uses, it reports on all files that have been removed, added, modified or duplicated. It can tighten baseline configuration control down to a single bit. It can also be used with surgical precision on an entire system or single file. The CIT tool produces a database of cryptographic hash values for every file it is directed to manage.

The UAD tool, besides it's use in anti-virus protection—is built for making identification based upon direct inspection of the data. It make no assumptions about the file's contents based upon the file's name. Which increases response and reduces downtime. This tool also provides the ability for proper data identification through "context switching" which allows for greater degree of anti-virus protection when files are used in both Windows and UNIX.

MVFilter disinfects OLE documents (Microsoft Word, Excel and PowerPoint) from macro viruses (both VBA and Word Basic). The MVFILTER has a specific advantage over the competition—eliminating and preventing a ghost virus. MVFilter prevents ghost virus by zeroing out the entire virus and macro name, and leaves nothing for another virus scanner to detect.

AVA, included in your maintenance and support, is a service that can provide automated, accurate, and rapid responses to cyber threats in the event of a cyber war or other major event.

VSTK Turbo

The VFind™ Security ToolKit Turbo (VSTK-T) enables the additional functionality of VFind™ Daemon and Avatar™.

The Daemon provides user applications virus scanning and detection services at a high level of performance. Running as a daemon process, it eliminates the need to re-initialize the scan engines on each request. Reducing the need to use system resources by processing files as they are received, improving response time and minimizing the effect of virus scanning on the main application.

Avatar maintains the system baseline configuration. It does so by executing system security policies that act as an intrusion detection and response system.


Get started with the VFind™ Security Toolkit with VSTK Lite, containing core tools for basic scanning functionality. VSTK Lite is for those customers who need a basic virus scanner but without any of the additional security tools. The Lite toolkit includes the multi-threaded VFind-MT along with VFind, UAD and VDL management tools.

VSTK for Windows

VFind for Microsoft Windows is a new product that brings all of the flexibility and innovation of VFind Security Toolkit Standard to Windows. A new Microsoft Windows centric graphical user interface insures that everyone can use the tools without special knowledge.

Advanced users still have direct access to the individual tools without the need to access the GUI. VSTK for Windows includes multi-threaded vfind-mt, UAD and VDL management systems.


Main Tools of VSTK


VFind™ is the virus scanner and pattern analysis tool in the toolkit, and is unlike any other anti-virus program in existence. It was the first anti-virus scanner for UNIX, the first heterogeneous scanner and the first scanner to incorporate a full virus description language, CVDL. Unlike most virus scanners, it actually searches for attacks in a file, based upon what the file actually is. Most virus scanners assume that the filename is a description of the file type. VFind™ determines the file type by direct examination of the file's contents. This makes VFind significantly more powerful than other anti-virus products that only examine files with the “.com” and “.exe” extensions.

The VFind™ Security Toolkit Family of computer security products offers so much more than just virus scanning-with these toolkits. Our VSTK family of Products supports all UNIX type operating systems including UNIX, Linux (all versions), Solaris, AIX, IRIX, HPUX and others. CyberSoft is able to support any operating system upon request. Our anti-virus, VSTK family of products includes a virus scanner with a fully published, accessible pattern analysis language and a cryptographic integrity tool for baseline management. The VFind Toolkit provides tools to deal with hidden threats, self-repair tools and more. Our products are easy to integrate with any other program.

Apply For A Free 30-Day Demo

Cryptographic Integrity Tool

The Cryptographic Integrity Tool (CIT) detects virus, hackers, sabotage and baseline configuration violations from any source, using cryptographic change detection, reducing help desk turnaround time from hours to minutes! An end-user calls stating the system doesn't work...they claim they didn't change anything, and a proposal is due out the door by noon. Is it a user error, a virus attack or sabotage? CIT will never lie and cannot be tricked!

Universal Atomic Disintegrator

The Universal Atomic Disintegrator (UAD) solves two difficult problems—identification and decomposition. Decomposition of a file to it's smallest indivisible parts (universal atomic disintegration using classical Greek language meanings) is a difficult problem. First the program must have infallible identification of the file in order to decompose it. This is not a problem for UAD, which identifies the file by direct examination of it's contents.

Visual Scan

CyberSoft has always provided advanced graphical user interfaces for those users who want the ease of a GUI under Unix/Linux and Microsoft Windows. CyberSoft is committed to meeting all technological demands and remaining on the forward edge of technology. This is our 5th version of a GUI, having advanced from X-windows XView, Motif, TCL/TK, HTML to our latest offering using advanced C++ with Qt.

Visual Scan provides more functionality than ever before while maintaining an easy to understand, intuitive interface with advanced features. Features include scanning, log file management, quarantining, scheduling, automatic updates and system integrity management all from one interface.

Visual Scan is cohesive and well integrated, making it easy to get started and leverage VSTK's core functionality to work for you.


Put simply, MVFilter disinfects OLE documents (Microsoft Word, Excel and PowerPoint) of macro viruses (both VBA and Word Basic). It does this in the same way that all anti-virus programs disinfect macro viruses, by removal of the macro. The difference is that MVFilter was designed as a tool, and as such, it can be used for compartmentalization purposes in addition to it's reactive disinfection role.

Loopback Head and Loopback Tail

Loopback Head & Loopback Tail (LBH & LBT) ensure that unchanged (but infected) files are re-analyzed by VFind™. LBH reads filenames from a user-customized database; LBT uses the VFind™ output to create a database suitable for use with LBH.

Loopback Head and Loopback Tail

The Java Disassembler (JDis) The only sure-fire method of scanning java code for viruses is to break down the byte code to associate constant pool structures with their operations. JDis quickly and efficiently disassembles Java Byte Code for a VFind™ antiviurs scan, which is essential when confronting the latest Java-based Trojan Horse virus.


Bhead is a simple tool the solves complex issues. UNIX systems do not have a convenient way of scanning for boot sector viruses, and scanning an entire drive just to detect a boot sector virus wastes time - BHead reduces the byte stream to the portion of the drive to allow the boot sector to be scanned.


AVA is a system which provides automated, accurate, and rapid responses to cyber threats in the event of a cyber war or other major event. Additionally, it continuously monitors the cyber landscape, identifying new threats and automatically adapting malware definitions to identify them. This service is always included with your active maitenance and support subscription.

Tools Available with Turbo

VFind™ Daemon

The VFind Daemon provides user applications virus scanning and detection services at a high level of performance. Running as a daemon process, it eliminates the need to re-initialize the scan engines on each request. All files are processed as they are received, improving response time and minimizing the effect of virus scanning on the main application.

VFind Daemon file scanning and virus detection services are accessible to any application running on a user's system. It's multi-threading capability enables it to scan requests from multiple applications concurrently. Applications can access VFind Daemon services through an easy-to-use message interface. The Simple Virus Scanning Protocol (SVSP) is a text-based, request/response interface that gives applications full access to VFind Daemon services. SVSP includes commands that enable the program to set scanning options on a per-request basis and to specify the file to be scanned. Requests can be tagged so that the subsequent responses can be matched. This allows the anti-virus application to submit multiple scan requests and be able to match the asynchronous responses. A client program is also provided to further simplify accessing and using VFind Daemon.

VFind Daemon can also support the interfaces for other available virus scanning daemons, for example: ClamAV's and clamd. This makes it possible to incorporate VFind Daemon into an existing system with minimal software changes and enables applications to migrate towards utilizing VFind's additional capabilities as required.

The multi-threading capability enables VFind Daemon to scale gracefully and take advantage of systems with multiple processors. The thread number used by VFind Daemon is configurable and can be set to match the available computing power.


Avatar maintains the system baseline configuration. It does so by executing system security policies that act as an intrusion detection and response system.

The most important function of Avatar is response - if the system baseline configuration is modified for any reason, it will be detected by Avatar and returned to the correct baseline configuration.

The value of Avatar's response system is that it enforces discipline via non-subjective automated process, which can execute many times per day.

Anti-virus Testing

In-House Testing

To deliver to our customers the best in UNIX, Linux, and Mac OS X security solutions, CyberSoft products are tested against the highest industry standards, utilizing a multi-layered testing strategy.

The first layer of internal testing is to determine that VFind will detect each individual virus signature that it's designed to detect. Our next round of tests ensures that VFind does not falsely identify legitimate files as infected files, which could interfere with the operations of our customers.

The next layer of testing is performed on a daily basis:

Wildcore Test: All virus samples in our Wildcore-DB should be detected by new VDL set. We update our Wildcore-DB monthly and the size is growing continuously.

Falsehit Test: All clean samples in our Falsehit-DB should not be detected by new VDL set. In addition to this regular test, our engineers perform additional falsehit tests with a much larger more comprehensive falsehit database.

VDL Syntax Test: To check if the VDLs properly follow CVDL syntax.

VDL Duplicate Test: To avoid having duplicate VDLs.

Currently, we post new VDLs every morning, after successful completion of the above tests.

If any one of the tests fails, VTP stops posting procedures and sends a failure notification to related people to investigate the issue. If we or customers receive a (posting) notification email, that means our new VDL set successfully passed all the four tests.


CyberSoft continually updates this information as new technologies are released and others are deprecated. We will port to any system for the cost of the system. If the OS software is free and will run under a virtual machine, then there is no charge.

VSTK Compatibility Chart

The following table represents feature compatibility chart for VSTK Release 182. For information about older releases, please contact us for more information.

Operating System Architectures Multi-Threading GUI
AIX 4.3 PPC No No
AIX 5.1 PPC No No
AIX 6.1 PPC Yes No
Debian 4 x86 Yes No
Debian 5 x86-64 Yes No
Debian 8 x86, x86-64, ARMv7 Yes No
Debian 9 x86, x86-64, ARMv7 Yes No
FreeBSD 7 x86 Yes No
FreeBSD 10.3 x86 Yes No
FreeBSD 11 x86-64 Yes No
HP-UX 11.00 HPPA, Itanium Yes No
Red Hat EL 5 x86, x86-64 Yes No
Red Hat EL 6 x86, x86-64 Yes Yes
Red Hat EL 7 x86, x86-64 Yes Yes
Solaris 8 SPARC Yes No
Solaris 9 SPARC Yes No
Solaris 10 x86, x86-64, SPARC Yes No
Solaris 11 x86, x86-64, SPARC Yes No
SUSE 9 x86 Yes No
SUSE 10.1 x86 Yes No
Ubuntu 8.04 LTS x86 Yes No
Ubuntu 10.04 LTS x86 Yes No
Ubuntu 12.04 LTS x86, x86-64 Yes No
Ubuntu 14.04 LTS x86, x86-64 Yes Yes
Ubuntu 16.04 LTS x86, x86-64 Yes Yes