Hexward, free malware scanner for Windows

Detection

  • File-name tricks
  • Known-bad hashes
  • Signature rules
  • Programs in disguise

Hexward, malware scanner for WindowsFree, open source · phase 1

Every byte, warded.Scan a suspicious file live, then help everyone by sending it to the lab.

</0.01> Product

Hexward is a free, open-source malware scanner for Windows, written in Rust.

It checks every file the cheapest way first, moves confirmed threats into an encrypted quarantine, and never touches what it isn't sure about. Its virus database is built with the community: every confirmed sample people submit ships to every user in the next update.

Scan a file nowRoadmap

How it detects, cheapest check first

  • 01 · File nameinvoice.pdf.exeHidden right-to-left characterSpace-padded names
  • 02 · SHA-256 listExact known-bad filesConfirmed
  • 03 · EICARThe standard antivirus test fileBuilt in memory
  • 04 · Signature rulesPatterns inside filesYARA-X in the app
  • 05 · ContentWindows programs disguised as images or documents

</0.02> Features

What Hexward does today

Works · phase 1

Scan

A quick scan of Downloads, Desktop, Temp, startup items and running programs, one folder, or every drive, with a clear report of what was found and why.

How it detects
Works · phase 1

Quarantine

Confirmed threats are encrypted with ChaCha20-Poly1305 so they can't run, then the original is removed. If the file is in use, nothing changes. One command restores it.

Works · phase 1

Startup check

Lists what starts with Windows and flags entries that look wrong. Missing files are usually leftovers from apps you uninstalled.

New · community

Community submissions

Anyone can scan a suspicious file in the browser and send it to the lab. Confirmed samples become signatures in the next database update.

Submit a sample

</0.03> Submit a sample

Found something nasty? Scan it here, then send it to the lab

The live scan runs Hexward's own checks right here in your browser. Your file is not uploaded unless you choose to send it.

  1. 01

    Drop the file

    An executable, script, document or archive you don't trust. Up to 32 MB.

  2. 02

    Live scan on your device

    File name, SHA-256, EICAR, signature rules and a disguise check, in about a second.

  3. 03

    Send it to the lab

    Add a note on where it came from. It is encrypted the moment it arrives, so it can't run.

  4. 04

    The lab reviews it

    We analyse every new sample in an isolated machine and check it against clean software, so good files are never flagged.

  5. 05

    Everyone gets protected

    Confirmed samples become signatures and ship to every user in the next database update.

Please only send files you are allowed to share, and never personal documents. The lab never shares submitted files.

Live scanDatabase v… · … signatures

</0.04> Virus database

A database that grows with every update

  1. Step 01

    Submitted

    People send files that look wrong, from anywhere in the world.

  2. Step 02

    Scanned live

    Hexward's checks run instantly, so known threats are answered on the spot.

  3. Step 03

    Reviewed

    New samples are analysed in an isolated machine and tested against clean software.

  4. Step 04

    Signature written

    A hash and a rule are added, with a plain-words description of the threat.

  5. Step 05

    Shipped

    Every Hexward update brings the bigger database to every user.

Signatures in the database today0

Database v…. Known-malware fingerprints from the curated YARA Forge rule set, plus every sample the lab confirms from community submissions.

Samples sent to the lab…

Counted by this server. Every sample is stored encrypted and reviewed by a person.

Detection layers per file0

File names, SHA-256 hashes, the EICAR test file, signature rules and content checks.

</0.05> Why open source

Security you can read, line by line

An antivirus asks for a lot of trust. Hexward earns it by showing every line of its code.

</0.06> Roadmap

Built in the open, one phase at a time

Phase 1 · nowScanner

On-demand scanner

Scan, report and quarantine. Next: rule packs with an update command, and false-alarm testing on clean software.

Phase 1 · laterApp

Desktop app and ML model

The pixel desktop app, and a machine-learning model for Windows programs.

Phase 2Real-time

Real-time protection

Watching files as they're written and run, starting with Windows event tracing, then a file-system driver.

Phase 3Proof

Proven, not promised

Join the Microsoft Virus Initiative, enter independent lab tests and publish the results, good or bad.