Hi,
I’ve developed and maintained a professional anti-malware solution in the past (later acquired along with its technologies, and I still continue its development internally for the company that acquired it). So I know firsthand what it really takes to build a serious security product.
At this stage, OmniDefender looks more like an AI demo than a true AV solution:
– Real-Time Protection: instability and silent crashes are unacceptable. A real security engine must run in kernel mode with watchdog/recovery mechanisms to guarantee stability.
– AI Custom Scan: this is not “cutting-edge AI” – it’s simply a large language model generating nice-looking explanations. Malware isn’t detected through prompts.
– Privacy contradiction: claiming to be privacy-focused while your policy states that you collect all user-provided data undermines your credibility.
– Design vs. substance: a polished UI doesn’t compensate for weak detection. In security, stability and detection rates always come before aesthetics.
Right now, OmniDefender feels more like a FakeAV boosted with ChatGPT than a next-gen solution. If you want to be taken seriously, you’ll need to:
Until then, most professionals will see this as a marketing experiment rather than a cybersecurity product.
- Prove bulletproof stability in real-time protection.
- Publish independent test results (AV-Test, AV-Comparatives, etc.).
- Demonstrate an actual detection engine beyond a dressed-up LLM explanation.
And a real engine, not something under Claude3, because even the oldest malware slips through undetected(tested with Brontok again tonight, even Virus.Zombie slips through and kills the VM....)
Your Discord link is invalid...
Um, seriously, Facebook detection on your screen?![]()
I wasn’t going to bring this up, but since we’re talking about credibility… According to official French company records, the founder of OmniDefender is legally registered as a food delivery courier (think Uber Eats), not as a cybersecurity professional or software developer.
So when you market yourself as an ‘AI-powered next-gen antivirus vendor’, but your official business activity is literally delivering meals by bike, it’s hard to take the project seriously.
Cybersecurity isn’t delivered on a bicycle. Building a real AV engine takes years of R&D, telemetry pipelines, kernel-level development, and proven results — not React dashboards glued on top of VirusTotal and GPT.
This isn’t professional cybersecurity, it’s a hobby project dressed up as something it isn’t.
So I actually tested your “OmniDefender” setup in a VM (a 600 MB MSI). Thanks @Shadowra
Here’s what really happens:
- Doesn’t even auto-launch after install, you have to manually start “real-time protection” from Program Files
- UI is just a laggy React/Electron wrapper, eating 90% CPU on every click
- No kernel service, no memory scanning, no callbacks → RunPE / Process Hollowing = full party in RAM
- Detection “engine” = hash lists + a LightGBM score that basically always says BENIGN
- My test ransomware (non-obfuscated) was flagged BENIGN (AI), while Microsoft’s own VCRUNTIME DLL got flagged as MALWARE
- Everything runs entirely in admin-land user mode, nothing in Ring 0 → no kernel service, no real drivers
So yeah… this isn’t “Next-Gen Antivirus.”
It’s a 600 MB joke built on GitHub copy/paste and ChatGPT prompts.
Name fits better as OmniDefeated![]()
Yeah I managed to, but honestly it took an insane amount of time for… basically nothing in the end
The “update” is just as useless as the rest of the program, felt more like watching paint dry than updating an AV.
Forgot to mention: if you click ‘Close’ in the main window, the whole thing just crashes.
An “update” requires someone to actively work on expanding the detection logics.
When these detection logics are tangled with an ineffective platform (no kernel drivers, no behavioural blocking, no local/cloud emulation and so on), the update doesn’t matter.
An antivirus with no kernel drivers and exceptionally limited user mode visibility will:
-Barely detect any malware, when it does, it will be late and will use user-mode calls like NtTerminateProcess (which malware can easily resist).
-It will be wrecked by malware due to lack of self-protection
-This architecture is a step above command line scanner, the only difference is the addition of GUI.
Such product is not security software, it is a placebo.
It combines bugs (silent crashes, racing conditions), with architecture that is by no means suitable for the job (unfit for the purpose) and creates a false sense of security. The addition of Claude/LLMs is there to evoke a sense of technical sophistication, whilst the underlying code is a joke.
To get to the “Next-Gen” you first have to perfect the “Current-Gen”.
View attachment 290549
It detected Edge as malware LOL
Well, now you're protected
View attachment 290550
Exactly.
AI is just one layer in the stack, useful for obscure patterns or unknown samples, but it’s always controlled by:
Otherwise, you get what we see with OmniDefender: AI run wild, labeling Edge as an APT and Acrobat as a trojan, while missing actual ransomware.
- Heuristics from real analysis → the engine applies strict rules from reverse-engineering experience.
- Cloud whitelist → massive collections of trusted files to avoid “Adobe = trojan” type of nonsense.
- Scoring system → AI output is just a coefficient, not the final verdict. The decision is made by combining AI + heuristics + file reputation.
Yes exactly. Signature verification and safe program regex are evaluated first. AI is just an additional signal, never the final judge. If a file is signed with a trusted cert (like MS Class 3) or matches known safe binaries, it bypasses AI scoring completely. Otherwise you end up with the OmniDefender circus.
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS It causing this bsod.
There seems to be a lot of misunderstanding in this thread (intentional spite or not).
We've already mentioned that Version 1.4 will be worked on from early August. We've already received the same feedback on Version 1.3 so why continue testing the same version? Custom Scan's functionality has already been explained, it serves as an educational tool to help users learn of the potential of an unknown sample through static analysis. It has not, does not and will never serve as a malware detection method.
We collect user provided data only in the website, mainly from authentication and payment methods.
Our solution to this date is only 2 months old. While other are better solutions that may be younger or older, especially high end solutions that are around 8 years old to over 30 years old. That enormous age gap gives them more time to enhance their solution.
But we will simply continue to release updates for OmniDefender so that in the following years, our team will be large enough to compete with the largest solutions.
Another misunderstanding, OmniDefender does not integrate any LLM in it's detection engine.
Another misunderstanding. The link in the screen is hxxp://wwww-facebook.com and isn't the real facebook.
View attachment 291625
Another misunderstanding, although you claim to have maintained a professional antivirus solution, you don't seem to understand what the french company records store about a company nor actually read my companies main activity. Avis de situation au répertoire Sirene - Insee is the official INSEE portal. It provides administrative identity and current status of all French companies. It displays the current status, SIRET of the head office, head office address, legal category and the main activity of the company. No where does it request or provide the qualifications (degree, certifications) of the owner. Have you actually created a company before @RoxasDev?
View attachment 291626
Auto-launch is optional and not relevant. Nor do you need to start real time protection from program files. It seems you were intentionally avoiding the GUI for some reason. "No kernel service", another wrong statement. OmniDefender has 3 kernel drivers, including callbacks and memory scanning.
The detection engine in 1.4 has multiple layers. Digital Signature -> Signature Analysis -> Policy Gate -> Custom Static Rules -> External Rules (YARA) -> SRP Analysis (replaces TLSH) -> Gradient Boosted Anaylsis.
An unknown file may be flagged benign statically due to insufficient proof of maliciousness but will still be blocked behaviorally.
"Everything runs entirely in admin-land user mode", completely wrong. "ChatGPT Prompts", ChatGPT is unreliable when it comes to producing decent code but is excellent for research, we don't rely on ChatGPT's code, it produces endless errors and runtime issues. That should be obvious.
Automatic Updates sometimes fails due to multiple reasons, proxies, PAC, captive portals, slow links, antivirus SSL inspection, etc.
Updates of the database are pushed to the website regularly, which automatic updates retrieves.
"An antivirus with no kernel drivers", it's unfortunate to see that no one has actually bothered to check.
"Barely detect any malware", another big misunderstanding, our priority on release was not a high detection rate on Version 1.0, but stability and functionality. Performance is worked on after everything else is deemed functional which takes time.
Bugs are common in complex software, especially during the first year of release. That's why patch notes exist and are provided to fix and enhance
The structure of elevation services are quite common in malware that attempt privilege escalation attacks. Which is why elevation_service.exe was flagged. This is still a false positive and will be worked on.
OmniDefender also has a scoring system, whitelist and heuristics. However the thresholds are still being fine tuned to minimize false positives.
Signature Verification is also a part OmniDefender's detection engine, however they were not fully impletented in Version 1.3.
When I turn on this happens that's why this happening.Thank you for the feedback, this is a simple patch and will be released in 1.4.1 within 3 days.
There's no problem here. You simply didn't run real time protection so the tray is complaining.
If you’re going to respond, at least try to do it without proving my point in real time.
You keep repeating “misunderstanding” as if the problem is comprehension, not competence. It’s not that people misunderstand you — it’s that what you’re describing simply doesn’t exist beyond your imagination.
Let’s recap:
And please — stop hiding behind INSEE definitions. Nobody cares whether your registration line says “food delivery” or “quantum cybersecurity startup.” What matters is that your product behaves like the former and pretends to be the latter.
- A two-month-old hobby project with a laggy Electron shell, no credible driver stack, and a “gradient-boosted” buzzword salad isn’t a security engine.
- Throwing acronyms like YARA, SRP, and TLSH doesn’t make you a malware analyst. It just shows you’ve spent too much time on GitHub scraping other people’s code.
- “We’ll improve over the years” is not a development roadmap. It’s an admission that right now, OmniDefender is unfinished, unstable, and unfit for purpose.
Real security software isn’t built on PowerPoint slides and marketing buzzwords. It’s built on kernel stability, telemetry infrastructure, and a proven ability to stop real threats — none of which OmniDefender currently demonstrates.
You can keep trying to argue semantics, but as long as your software keeps crashing, flagging Edge as malware, and missing decade-old viruses, no amount of “gradient boosting” is going to change the verdict.
You don’t need better PR.
You need an actual engine.
Seems like your replies themselves are AI generated.
If you're going to critique, at least provide context and actually write yourself. Right now "laggy electron shell" definitely shows you're just copy pasting from ChatGPT. Not once have I ever mentioned that OmniDefender was made with electron, yet you're telling me the issue isn't comprehension when you still haven't haven't understood OmniDefender's framework. Where's the context for "No credible driver stack"?
"Gradient-Boosted" isn't a buzzword. "Machine Learning" and "AI" are more likely to be used as buzzwords.
You're assuming I've been scraping github for other people's code, where did this even come from? Even if it was true, isn't the goal of open-source code meant for shared contribution and inspiration? By your logic I'm forbidden from learning and being inspired from ClamAV's functionality and code practices?
"“We’ll improve over the years” is not a development roadmap".
Well of course it's not a roadmap, a roadmap provides a forecast of what new features will be implemented at what time.
"Real security software isn’t built on PowerPoint slides" ????
"software keeps crashing, flagging Edge as malware, and missing decade-old viruses, no amount of “gradient boosting” is going to change the verdict."
All these were tested on an 8 day old antivirus whose immediate focus wasn't on pure performance but functionality and stability.
"two-month-old hobby project", do you actually have a relevant or a credible career to assume that a software released 2 months ago would also simultaneously have 2 months of development pre-release?
Which driver terminates viruses? Because Zemana get abused by this way.Seems like your replies themselves are AI generated.
If you're going to critique, at least provide context and actually write yourself. Right now "laggy electron shell" definitely shows you're just copy pasting from ChatGPT. Not once have I ever mentioned that OmniDefender was made with electron, yet you're telling me the issue isn't comprehension when you still haven't haven't understood OmniDefender's framework. Where's the context for "No credible driver stack"?
"Gradient-Boosted" isn't a buzzword. "Machine Learning" and "AI" are more likely to be used as buzzwords.
You're assuming I've been scraping github for other people's code, where did this even come from? Even if it was true, isn't the goal of open-source code meant for shared contribution and inspiration? By your logic I'm forbidden from learning and being inspired from ClamAV's functionality and code practices?
"“We’ll improve over the years” is not a development roadmap".
Well of course it's not a roadmap, a roadmap provides a forecast of what new features will be implemented at what time.
"Real security software isn’t built on PowerPoint slides" ????
"software keeps crashing, flagging Edge as malware, and missing decade-old viruses, no amount of “gradient boosting” is going to change the verdict."
All these were tested on an 8 day old antivirus whose immediate focus wasn't on pure performance but functionality and stability.
"two-month-old hobby project", do you actually have a relevant or a credible career to assume that a software released 2 months ago would also simultaneously have 2 months of development pre-release?
Another misunderstanding, OmniDefender does not integrate any LLM in it's detection engine.
@OsirisXD
So if you don't have an LLM engine or anything else, how do you create the detections? (the ones I mentioned)
Let me clarify, I'm not here to kill your project, just to understand and test it.
In fact, I've already done so on a fresh VM: Your resident protection doesn't work for me...
It's impossible to test it, even after rebooting the machine. Your agents crash after about 30 seconds, when your service reaches 100% CPU usage.
I use React too in some of my projects (though I don’t discard vue js and Angular either). But this is just the user interaction… besides the interaction there are many other important points to take care of.That’s exactly why I said earlier this thing is built with React/Electron it’s ridiculously heavy and unstable.
Those frameworks were never meant to power an antivirus, but hey… apparently I’m the one “using ChatGPT to write my replies,” right?![]()
I use React too in some of my projects (though I don’t discard vue js and Angle either). But this is just the user interaction… besides the interaction there are many other important points to take care of.
Yeah, sciter is more suitable.Yeah, React is great for building clean, lightweight user interfaces but for an antivirus interface, it’s completely the wrong framework for the job.
@OsirisXD
So if you don't have an LLM engine or anything else, how do you create the detections? (the ones I mentioned)
Let me clarify, I'm not here to kill your project, just to understand and test it.
In fact, I've already done so on a fresh VM: Your resident protection doesn't work for me...
It's impossible to test it, even after rebooting the machine. Your agents crash after about 30 seconds, when your service reaches 100% CPU usage.
Honestly I might consider reverting to a beta version and remove the paid versions and make OmniDefender completely free and continue enhancing it for the distant future until it's safe and good enough to compete with other larger solutions. My goal wasn't to monetize this project immediately anyway but receive valuable feedback like yours to continue enhancing it, nor was it to get this much hate.
If you're wondering why there's such a CPU spike when starting OmniDefender, its mainly because several engines are being started simultaneously. Are you still able to start real time protection?