How captain-coding74/avguard works
AVGuard is a Windows file-scanning application with GUI and CLI entry points. The main workflow is user-selected or monitored files → guarded scan and detection evidence → verdict/reporting → optional quarantine, with restore/export as recovery paths. Separate branches provide integrity baselines, IOC blocklists, rule-pack management, scheduled scans, and event history. The README documents these capabilities and module responsibilities; sampled excerpts are partial, so uncertain internal call wiring is omitted.
Main entry points: scanner.py Scan engine · __main__.py CLI · gui.py Desktop GUI · watcher.py Realtime watcher
Components 24
User interfaces
- CLI
avguard/__main__.py - Desktop GUI
avguard/gui.py
Scanning and detection
- Scan engine
avguard/scanner.py - YARA rules
rules/malware.yara - Rule packs
avguard/rulepacks.py - Archive inspection
avguard/archives.py - PE analysis
avguard/peinfo.py - Signature checks
avguard/signing.py - Similarity matching
avguard/tlsh.py - Self-protection
avguard/protection.py - VirusTotal lookup
avguard/cloud.py
Threat response
- Quarantine and restore
avguard/quarantine.py
Monitoring and integrity
- File integrity
avguard/fim.py - Realtime watcher
avguard/watcher.py - Scheduled scans
avguard/scheduling.py
Configuration and records
- IOC blocklist
avguard/iocs.py - Event history
avguard/events.py - Settings and paths
avguard/config.py - Single-writer lock
avguard/instance.py - Logging
avguard/logsetup.py
Other components
- User
- VirusTotal
- Filesystem
- MalwareBazaar feed
Connections 36
- User → CLI: runs commands
- User → Desktop GUI: uses
- CLI → Scan engine: requests scans
- Desktop GUI → Scan engine: requests scans
- Realtime watcher → Scan engine: dispatches changed files
- Scan engine → Self-protection: checks paths
- Scan engine → YARA rules: matches rules
- Scan engine → Rule packs: loads pack rules
- Scan engine → Archive inspection: inspects archives
- Scan engine → PE analysis: checks structure
- Scan engine → Signature checks: checks signatures
- Scan engine → Similarity matching: matches similarity
- Scan engine → IOC blocklist: checks hashes
- Scan engine → VirusTotal lookup: requests lookup
- VirusTotal lookup → VirusTotal: queries
- CLI → Quarantine and restore: lists restores exports
- Scan engine → Quarantine and restore: moves malicious files
- Quarantine and restore → Filesystem: moves and restores files
- Realtime watcher → Filesystem: watches changes
- File integrity → Filesystem: hashes files
- CLI → File integrity: runs integrity commands
- Desktop GUI → File integrity: manages integrity checks
- CLI → IOC blocklist: imports and updates
- IOC blocklist → MalwareBazaar feed: fetches feed
- CLI → Rule packs: manages packs
- Desktop GUI → Realtime watcher: controls monitoring
- Desktop GUI → Scheduled scans: configures schedules
- CLI → Scheduled scans: controls schedules
- Scan engine → Event history: records scan events
- Desktop GUI → Event history: shows history
- CLI → Settings and paths: reads settings
- Desktop GUI → Settings and paths: reads and saves settings
- CLI → Single-writer lock: acquires writer lock
- Desktop GUI → Single-writer lock: acquires writer lock
- Scan engine → Logging: records diagnostics
- Desktop GUI → Logging: shows log feed