On-demand, multi-engine malware scanning for Windows — scan folders, downloads, and large archives with up to three engines (ClamAV, Emsisoft, Microsoft Defender), working around the file-size limits that make a naive antivirus scan miss things.
It is on-demand: nothing runs in the background. You scan something once, when you choose to.
Pointing a signature scanner straight at a large archive (a multi-gigabyte .rar/.7z/.zip) often doesn't do what you expect, for two reasons this tool handles for you:
-
ClamAV has a hard 2 GiB-per-file limit. Large downloads frequently contain single data files bigger than that. ClamAV silently skips them and reports
OK— a scan that inspected nothing. avscan detects these, reports them honestly as skipped (not clean), and focuses the scan on the parts that matter. -
Executable code is the real risk surface, not the large opaque data blobs. avscan extracts just the executable/script files (
.exe,.dll, launchable packages, scripts) from an archive with 7-Zip, scans those thoroughly, then cleans up — fast, and it never wastes time on (or falsely clears) the large data files.
It also distinguishes a real detection from noise:
- ClamAV's
Heuristics.Limits.Exceeded.*is a size skip, not a virus. - A single engine flagging a packed/obfuscated executable is frequently a false positive. avscan flags single-engine disagreements and suggests verifying the file's SHA-256 on a multi-engine service before acting, rather than crying wolf.
| Platform | Tool | Engines |
|---|---|---|
| Windows | windows/scan-av.ps1 |
ClamAV + Emsisoft Emergency Kit + Microsoft Defender |
| macOS / Linux | macos/scan-archive |
ClamAV |
Each engine is independently toggleable in Settings. Optionally, ClamAV can pull third-party (SaneSecurity) signatures, and when a VirusTotal API key is configured the SHA-256 of any flagged file is checked against VirusTotal's multi-engine database automatically — deduplicated, cached for 7 days, and throttled to the free tier's 4 requests/minute. Two further VT options:
- Per-folder "VT: all files" mode — the VT badge on each folder card switches
that folder to also reputation-check all new/changed executables against
VirusTotal on every scan, even when the local engines find nothing (catches
fresh malware that signatures miss; ≥3 VT engines flagging counts as a
detection). Default is flagged-files-only.
-VtAllforces it for one CLI run. - Per-folder exclusions — expand a scan folder and click the SKIP badge on any sub-folder to exclude it (and everything under it) from every scan, always, even when its parent library is scanned. Excluded folders are dimmed in the app; clear the badge to re-include them.
- Upload unknown files (opt-in, Settings) — files VirusTotal has never seen are submitted for a full multi-engine analysis (max 650 MB; uploads are shared with the VT community, so never enable it for folders holding private files).
The Windows tool is both a command-line scanner and a touch/controller-friendly desktop app (WPF). The macOS/Linux tool is a small command-line script.
powershell -ExecutionPolicy Bypass -File .\windows\scan-av.ps1 -InstallThis copies the tool into %LOCALAPPDATA%\ScanAV, adds it to your PATH, creates a desktop shortcut, and offers to auto-download the engines (no admin required):
- 7-Zip — via
wingetif present, else the official installer into a user folder. - ClamAV — the official portable Windows build, then
freshclamfor the database. - Emsisoft Emergency Kit — downloaded and extracted, then
a2cmd /updatefor its database.
Downloads total several hundred MB (programs + signature databases). See Attribution for engine licensing.
Launching the Scan-AV desktop shortcut opens a dark, touch-first dashboard:
- A protection-status hero and a prominent Scan Now action.
- Scan Targets as expandable cards with large checkboxes — pick whole folders or specific sub-folders; give folders custom display names.
- Folder cards include quick actions to open in Explorer, move/rename into another configured scan folder, or edit the display label.
- Action tiles: Scan All, Scan Checked, Quick Scan, Update Definitions, Update App, View Logs, Add Folder. Add Folder uses the native Windows folder picker to choose a scan target.
- Quick Scan runs Microsoft Defender over only the
.exe/.dllfiles in the checked folders (or every configured folder if nothing is checked) and asks whether to re-scan everything (Full) or only new/changed binaries (Incremental). - Pages in a left nav rail: Dashboard / Scan / Updates / Logs / Settings / About. Scans run in-app and keep running when you switch pages; a header progress bar shows activity.
- Clean scan results show a next-step modal: close, choose a folder to rename/move into another configured scan folder, or choose an
.exeto run. The run action can apply Windows' System (Enhanced) high-DPI compatibility override. - In-app Settings (engines, third-party signatures, VirusTotal API key, scan mode, size limits, auto-update, incremental) and a log browser.
- Header controls include Update and Exit; Exit asks whether to minimize to tray or quit. The tray menu can reopen or exit the app.
The installer also creates two standalone launchers:
%LOCALAPPDATA%\ScanAV\ScanAV.exeopens the desktop app.%LOCALAPPDATA%\ScanAV\ScanAV-Updater.exeruns the GitHub self-updater in a visible update window.
If you use a launcher such as ROG Armoury, point it at ScanAV.exe instead of
the PowerShell script. App updates refresh both EXEs automatically. The normal
desktop shortcut targets ScanAV.exe directly, and the updater shortcut targets
ScanAV-Updater.exe. The optional zero-prompt shortcut still targets the Windows
scheduled task runner by design.
scan-av -Gui # open the app from the command line
scan-av -SelfUpdate # update to the latest version from GitHubscan-av # scan configured folders, both engines
scan-av -Path 'D:\Downloads\file.rar' # scan one archive or folder
scan-av -QuickScan # Defender-only sweep of every .exe/.dll (incremental)
scan-av -QuickScan -RescanAll # ...re-checking every executable, ignoring the cache
scan-av -Update # force a definition refresh
scan-av -RescanAll # ignore the cache and re-scan everything
scan-av -VtAll # also VT-check new executables this run
scan-av -Engine all # ClamAV + Emsisoft + Defender
scan-av -Configure # re-run setup
scan-av -AddFolder 'D:\Stuff' # manage the saved folder list
scan-av -InstallContextMenu # right-click "Antivirus Scan" (folders + files)
scan-av -ListQuarantine # list quarantined files
scan-av -RestoreQuarantine <name|all> # restore from quarantineExit codes: 0 clean, 1 threats found, 2 some items could not be scanned.
- Quick Scan (
-QuickScan) — a fast, Microsoft Defender-only pass that inspects only executable code (.exe/.dll) inside the target folders and ignores every other file type. Each executable is its own cache unit, so with the incremental cache a repeat Quick Scan only re-checks binaries that are new or changed;-RescanAll(or the app's "Full" choice) re-checks all of them. It ignores-Engine(always Defender) and honours the same per-folder SKIP exclusions as a normal scan. - Incremental scanning — a cache (
%LOCALAPPDATA%\ScanAV\scan-cache.json) records what has been scanned; unchanged items are skipped on later runs. Change is detected by size + modified-time (no re-hashing).-RescanAllforces a full re-scan. Items whose scan failed (engine error, encrypted/corrupt archive) are never cached as clean — they are reported and retried on the next run. - Crash-safe progress — the cache is written as the scan runs (checkpointed after each item, throttled to at most once every
options.cacheFlushSeconds, default 5s), not only at the end. If a long run is cancelled or killed part-way, everything already scanned is kept, so the next run resumes with only what's left instead of starting over. Each write is atomic (temp file + move), so an interrupted write can't corrupt the cache. - Move-aware — an item scanned clean and then moved (or copied) to another watched folder is not re-scanned: a clean cache entry with the same name and identical content signature (file count + total size + newest modified-time) is recognised as the same content at a new path and migrated. Renamed or modified items still re-scan.
- Batched ClamAV — all in-place items in a run are scanned in one clamscan invocation, so the multi-second signature-database load happens once instead of once per folder. Results are attributed back per item, so incremental caching still works per folder.
- Engine timeout — a stuck engine is killed after a configurable timeout (default 30 min) and the item is reported as not scanned, never as clean.
- Quarantine — flagged files (or the archive containing them) can be moved to
%LOCALAPPDATA%\ScanAV\quarantine, renamed so they can't run, and restored later (-ListQuarantine/-RestoreQuarantine, or the Quarantine button on a threat card in the app). - Auto-update — definitions refresh before a scan if older than a configurable interval.
- Explorer right-click — a per-user "Antivirus Scan" entry on folders and on archive/executable files runs an elevated scan of just that item (on Windows 11 it's under "Show more options").
- No-prompt Emsisoft — Emsisoft's
a2cmdrequires administrator, so Windows shows a UAC prompt on every scan that includes it. To stop the prompts, use the Set up no-prompt launcher button in Settings (orscan-av -NoPromptGuiShortcut): it registers an elevated scheduled task that launches the app and a "Scan-AV (No Prompt)" desktop shortcut that triggers it. Registering needs admin once; afterwards, opening the app from that shortcut starts it elevated with no UAC prompt, so Emsisoft (and every other engine) runs inline without ever prompting. This is the only way Windows lets a standard user start an elevated process with no consent prompt. - In-app results — the Scan page shows a real per-item progress bar and, when threats are found, result cards with Open VirusTotal / Show in Explorer / Quarantine actions; a tray notification fires when a scan finishes.
- Per-scan logs are kept in
%LOCALAPPDATA%\ScanAV\logs(pruned after 7 days).
Requires clamav and p7zip (e.g. brew install clamav p7zip).
cp macos/scan-archive ~/bin/ && chmod +x ~/bin/scan-archive
scan-archive '/path/to/file.rar' # scan the executable surface of an archive
scan-archive --full '/path/to/file.7z' # extract & scan everything
scan-archive --update '/path/to/file.rar' # freshclam first
VT_API_KEY=... scan-archive 'file.rar' # + VirusTotal hash lookup on detections| Result | Meaning |
|---|---|
clean |
No known-malware signature matched the scanned files. |
skipped (>limit) |
A file was too large for ClamAV (>2 GiB) and not scanned — not a verdict. |
| One engine flags it | Treat with suspicion but verify — packed/obfuscated executables can false-positive. Check the file's SHA-256 on a multi-engine service. |
| Both engines flag it | High confidence. Don't run it. |
Signature scanning is not proof of safety. A clean result means "no known signature matched." For anything from an untrusted source, get a multi-engine second opinion.
This project is a wrapper/UI around third-party scanning engines and tools. It does not include their code; it downloads and invokes the official builds. All credit for the actual detection belongs to them.
- ClamAV — open-source antivirus engine by Cisco Talos. Licensed under GPLv2. https://www.clamav.net
- Emsisoft Emergency Kit (
a2cmdcommand-line scanner) — by Emsisoft. Free for private/personal use only; commercial use requires a license. https://www.emsisoft.com/en/emergency-kit/ - Microsoft Defender (
MpCmdRun.exe) — the antivirus engine built into Windows; invoked in report-only mode. https://www.microsoft.com - SaneSecurity — optional third-party ClamAV signature databases. https://sanesecurity.com
- VirusTotal — optional multi-engine hash lookup (requires a free API key, set in Settings). https://www.virustotal.com
- 7-Zip — by Igor Pavlov. Used for archive inspection/extraction. https://www.7-zip.org
Built with PowerShell and WPF (Windows) / Bash (macOS/Linux). You are responsible for complying with each engine's license, especially Emsisoft's private-use terms.
MIT — see LICENSE. Provided as-is, without warranty. This is a convenience tool, not a substitute for a maintained, always-on security solution.