Everything that runs on your machine, listed without hiding anything

Automatic response

When a file comes back malicious, Malnox does not settle for telling you. It stops the process holding the file first — with its child tree, so a dropper cannot continue from another process — then quarantines it. Essential Windows processes (csrss, winlogon, lsass, services, svchost, explorer) and reserved PIDs are never touched: the request is refused and written to the audit log. There is also a per-minute intervention cap, so a cascade of false positives cannot turn into a loop that closes everything.

Real-time protection

chokidar watches Downloads, Desktop and Documents. On startup it waits 10–12 s for the event volume to settle, then processes one at a time. When the verdict is malicious the process holding the file is stopped, the file goes to encrypted quarantine and, if the move fails, execution is denied through an ACL. You can also choose reporting only.

Encrypted quarantine

AES-256-GCM, SHA-256-derived key, 12-byte IV and 16-byte tag. On restore the tag is verified: a modified blob is refused. Files in the legacy DQ1 format stay restorable.

Ransomware guard

Six canary files checked every 60 s. When more than 40 writes land in a short window the suspect processes are frozen — left intact for analysis and resumable — then the copies taken before writing are restored automatically. Order matters: encryption is stopped first, repair comes second.

Incident queue

Every detection becomes an incident with triage, deduplicated by hash — the same file will not fill the list 40 times. State changes from the dashboard or the API.

Enterprise controls

admin / analyst / viewer roles enforced per route, scrypt passwords with salt, 32-byte tokens stored SHA-256 hashed, an append-only audit log and SIEM export with a bounded queue of 512 events.

Signed intel, with rollback

Intel packages are HMAC-SHA256 signed and applied atomically: stage in a temporary directory, then rename. Path traversal is rejected, and the previous version stays for /api/intel/rollback.

Vulnerability scanner

Tells you which installed programs run versions with known problems, so you can update them before someone uses them against you.

The catalogue is ours and it is small: it covers the applications commonly found on a Romanian machine, not the whole CVE database. An “unknown” result appears when the version cannot be parsed — it is never rounded up to “fine”.

Privacy Guard

Shows which applications were granted access to your camera or microphone, and whether they used it recently.

Windows does not write a “last used” stamp on every build. When it is missing we report it as absent rather than inventing a date. The module does not block the camera: it shows you the permissions so you can revoke them yourself in Settings.

Firewall audit

Checks your Windows Firewall rules and flags the risky ones: a port open to everyone, a program living in a folder anyone can write to.

The module is strictly read-only: it neither creates nor deletes rules, because a wrong firewall change can cut you off the network. It tells you what needs fixing and you decide.

Exploit Protection

Shows whether the Windows mitigations that make a bug harder to exploit — DEP, ASLR, CFG, ACG — are on, both system-wide and per application.

Values Windows does not expose stay “unknown” instead of becoming “pass”. You can apply a baseline for the watched applications, but every change is written to the audit log.

Email Guard

Opens a saved .eml or .msg message and tells you whether it carries dangerous attachments, phishing links, or a sender who is not who they claim to be.

It does not connect to your mailbox: it scans files, not an IMAP account. The SPF/DKIM/DMARC checks read what the receiving server wrote — if the header is missing, the result is “unknown”, not “authentic”.

USB Guard

Lists the attached USB sticks and external drives, checks whether they carry an `autorun.inf`, and finds executables dropped in the root.

Without a signed driver we cannot block a device from mounting: we scan what is on it. AutoRun is disabled by default on Windows 10 and 11 anyway — the check still matters where it has been re-enabled.

Banking mode

While you are on a payment page, checks whether the domain imitates a known bank and whether the page asks for sensitive data somewhere unusual.

HTTPS does not mean “legitimate merchant”, and we do not pretend it does. A correctly spelled domain with a valid certificate passes even if the shop is dishonest — the module reduces risk, it does not remove it.

Security Health Check

One score, in plain language, that gathers everything we know about your machine and tells you exactly what is worth fixing first.

An “unknown” or “off” area scores zero, not half, while “attention” scores half. The score can therefore drop when a check cannot be performed — that is the intent.