Open Source C# Antivirus Software

Shortcut Virus Removal Tool (SVRT) Shortcut Virus Removal Tool is a powerful, portable, easy to use and safe program for fixing USB drives, external HDD / SSD drives and computers infected with shortcut virus. With only one click, you can remove shortcut virus from your computer and USB disk drive. It can restore files hidden by a virus and remove suspicious shortcuts and files from your USB drive and computer. It can repair registry and undo unwanted changes made by malware. It can also delete autorun virus from your USB drive. It has a very simple interface. You just have to select your USB drive from list and click Clean button. If the tool does not work, please right click and "Run as Administrator." The tool currently supports five different languages: English, German, Turkish, Arabic and Indonesian. This tool requires .NET Framework 4.0 and Windows XP or later.

Dynamic and static analysis with Sandboxie for Windows, including EDR, ClamAV, YARA-X, custom machine learning AI, behavioral analysis, NLP-based detection, website signatures, Ghidra, Suricata, Sigma, and much more than you can imagine

Fast antivirus software

Windwos Service to check if files has been changed by crypto ransomware. It does not prevent from ransomware infection! Don't use it in productive environments to prevent data loss! The Software comes without any warranty. If files has been changed it send a email and shutdown or disconnect the host or stop the server (LanmanServer) service to disconnect all shares on the server. The FileSystemWatcher object raises the events for the files in the monitored target folder. If a file in the monitor folder is changed by a user or programm a false alarm will be raised! It checks the MD5 hash of the monitor files for file changes. c# source is included in the zip file It uses the FileSystemMonitor class. The project is inactive because the software cant prevent against an infection.

Console application to check if files has been changed by crypto ransomware like Locky. It does not prevent from ransomware infection! Don't use it in productive environments to prevent data loss! The Software comes without any warranty. If files has been changed it send a email and shutdown or disable the network interfaces of the host. It runs under the user account and monitor drives which are connected to a server share. Works with remote to local Symlinks on a server share. Can map and monitor drives by using the subst or net use command. Can monitor multiple folders or drives. It communicates with a Windows LockyDisconnectService to disable all physical Network Interfaces (NICs). Use the commandline Parameter: -q to hide the console -i to add the console to windows autorun and install LockyDisconnectService c# source is included in the zip file It uses the FileSystemMonitor class. The Project is inactive because it can't protect against ransomware

With the Log Parser one can scan logs, whitelist out legitimate, non-corrupt entries (usually file paths), and apply a standard format to a log generated by any antivirus or malware-removal program. This makes for easier reading of the meat in any log.

Manual Virus Removal Tool 1.01-beta Platform: Windows ============ Information: ============ 1- This is NOT an Anti-Virus so don't assume it to be one. 2- If you don't know anything about file types specially (.exe/.bat/.vbs etc) then this application is useless for you. =========================== What this application does? =========================== You select a folder, click 'Unhide All' and MVRT unhides all the files and folders (even super hidden ones) inside the chosen folder. Then you can either go to that folder in the Windows Explorer and delete the .exe,.bat,.cmd,.vbs files or shortcuts you suspect to be viruses. Or you may choose the file in MVRT itself and click 'Delete File' to delete it. You can also check basic information about files like attributes and file size by choosing a file from tree and clicking "File Info". ==================================

Small and portable utility for protecting flash drive from autorun and another viruses, by quick filling out free space, preventing from creating even empty file, and more...

Proc Fine - and your Windows Processes will be fine! A little tool to manage all your Microsoft Windows processes.

Quickly recover problems that was created by viruses/malwares: Registry editor has been disable, task manager has been disable. also, contains sort of 'task-manager-replacement'. The name is a bit pretentious, but I couldn't think of any better name :-)

Antivirus engine with a set of virus databases and regular updates. Detects and cures all types of malware. Allows you to create your own anti-virus software without the creation of a personal virus lab, connect antivirus functionality to applications.

Windows Service to monitor drive c: for file events with crypto specific file extensions or with big file entropy. It does not prevent from ransomware infection! Don't use it in productive environments to prevent data loss! The Software comes without any warranty. When a alarm is triggerd it send a email and shutdown the host or disable the network interfaces. The alarm can be triggerd if locky extensions were found. Or if files were probably encrypted (big file entropy level). Or if a file event counter exceeds the allowed number of events in a certain periode of Time. Or if the the file extension does not represent a valid file because it has been encrypted. c# source is included in the zip file It uses the FileSystemMonitor class. The Project is inactive because the software cant prevent against an infection.

N.S.M Lite is a simple and easy way to manage your signatures for your Snort based IDS/IPS implementation, which can improve IDS/IPS signature development for accurate detection of malicious malware. Additionally, N.S.M can be used a learning tool to help you understand the complex nature of Intrusion Detection and/or Prevention (IDP) signatures for the Snort platform.

A very basic centralized management for Windows Defenders. It is in BETA state, but it is usable. It works only with Windows 10 Defenders. Updated the code: it is now compatible with build 2004 and it uses multithreading to query the machines. It uses PowerShell and SysInternalsSuite(PsExec.exe) to gather the information and it stores the data in a shared network drive (what the computers can access and have write access). It can store the data locally, if needed. What are the "computer name" background colors? -White: idle -Green: querying state -Pink: any other action besides querying -Red: one or more protections are disabled It can't show color on the highlighted row... What is planned? -to see the quarantine -delete from quarantine -whitelist from quarantine What else?