What leaves your machine, written in two columns

The Malnox minifilter (altitude 321000, port \MalNOXFilterPort) exists as real code: it compiles, links and passes signature verification in the test build. What we do not have yet is the official signature: loading it on a normal Windows needs an EV kernel-signing certificate and Microsoft Partner Center attestation. Until then, a file is stopped as soon as it appears on disk, and the process holding it is stopped with it — not at file-open time, a millisecond before execution.

Global reputation exists and is enabled in settings: an unknown local hash can be looked up in the Malnox network and the answer feeds the score. What it cannot do yet is compete with databases holding billions of samples — our network is young, and with it switched off the verdict comes from your local history alone.

The in-house rule package is small and behaviour-targeted. The signature engine covers the rest, but not at the scale of a huge commercial database. The rules are readable and extensible: you can add your own without asking us.

The sandbox unwraps every encoded payload and analyses what comes out — up to 8 encoding layers, across scripts, macros and, optionally, binaries. It does not run the file in a virtual machine or watch it execute: a payload that builds its own code at runtime, with no recognisable text slips past static analysis — but if it starts writing files or encrypting, the behaviour engines and the ransomware guard catch it at execution time.

Memory scanning looks inside the resident pages of running processes for the same indicators it looks for in files — including code built in memory that never touches disk. The result is de-noised: an API name imported from kernel32 is not evidence, injected code is recognised by its executable private page, and interpreter vocabulary is judged on the command line. What stays outside it: a process owned by another user or protected by the system cannot be opened without a driver, and is reported as “skipped”, never as “clean”.

Malnox reads Secure Boot, boot chain integrity, VBS, HVCI, KMCI, TPM and ELAM and tells you exactly what is on and what is not — 8 dedicated checks. A bootkit that installs itself before the operating system is not blocked, though: Malnox starts with your session, not earlier.

When hundreds of files are rewritten in seconds, Malnox freezes the processes running from the affected folders or carrying those paths in their command line, then restores the backups. Without a driver we cannot read another process's file handles, so an encryptor running from a different folder that does not pass its paths as arguments cannot be stopped pre-emptively — the files are restored, though.

Blocklist domains are written into the Windows hosts file on both IPv4 and IPv6, and the DNS cache is flushed after every write. The browser can no longer resolve them — that is real blocking, not a label in the console. What it does not do: it does not inspect traffic, and it does not stop a program that already knows the IP address and connects to it directly, bypassing name resolution. Inspecting all traffic would need a signed network driver, which does not exist yet.

Firewall, privacy, USB, exploit protection and vulnerabilities are audits: they read the Windows configuration, explain it and tell you what to do. They do not change firewall settings on their own, do not block a USB stick from mounting and do not revoke camera permissions. Automatic response covers files and processes, not system settings. The single exception, with explicit confirmation, is applying an exploit-mitigation configuration to an executable you pick.