TAP: network shield NT driver loads itself after TcpIp driver, NOD uses user-mode scanning, so it’s not very useful.

Lars: scanning is very fast, it uses the best scanning algorithm and there are not many signatures