Five layers,
one clear report.

On-demand scanning for Windows, 100% local: no connection, no account. Here is the detail of each layer and each safeguard.

The five layers

Each layer answers a different question about the same file, and the verdict comes from combining them.

01
SHA-256 hash

Compares each file's fingerprint with the local base and the lists you import: .txt with one hash per line, .csv from MalwareBazaar or .json in the program's format.
02
Content patterns

Looks for patterns of 16 to 256 bytes, up to 5,000 per base. On import it rejects short patterns, bare MZ/PE headers and trivial repetition, which cuts false positives.
03
YARA rules optional

Uses your rules or those from open sources. If a rule takes too long, the program warns you and never marks the file as "clean".
04
Static heuristics

Looks at entropy, executables with swapped extensions, packer sections and double extensions. It only marks suspicious from a combination of signals.
05
Reversible quarantine

The isolated file becomes <id>.qbr, with a manifest and SHA-256 check on restore. It never isolates anything in %SystemRoot%, Program Files or WinSxS.

A scan is useless if the result isn't readable or automatable. Both paths exist.

Report on screen, in HTML or in JSON

Result in the terminal for a quick read; --report-html to read at your leisure and --report-json to plug into another program.
An exit code that tells the truth

Clean, found something or incomplete scan: each result has its own code, ideal for automation.
Window in Portuguese, English and Spanish

The interface follows the system language. The scan result and the report come out in Portuguese.
Suspicious only goes if you ask

A file marked as suspicious only enters quarantine with --quarantine-suspicious. The default is to show and wait.

The program reads files in blocks and runs nothing. These are the protections built into how it works.

Never runs the sample

The analysis is static: the file is read, never opened by its own code.
Doesn't follow links or junctions

Shortcuts, symbolic links and folder junctions are not crossed, so it never leaves the folder you pointed at.
Ignores its own quarantine

What is already isolated is not re-analyzed or counted twice in the report.
Per-file size limit

--max-size defaults to 2 GiB; above that the file enters the report as skipped.
Hardlinks flagged

Isolating a file with hardlinks removes only one name; the other copies stay on disk, and the program warns you.
Network paths refused

UNC paths and names with colons (NTFS streams) are refused in quarantine and in restore.

See the prices and start with the product that's right for you.