OmniDefender - New Antivirus Software 2025

1759747393213.png

 
As promised, OmniDefender Version 1.4 is finally being released with MAJOR changes focusing entirely on Real Time Protection!

What's new in Real Time Protection:

- Real Time Protection now blocks malware at the earliest possible layer in the kernel, replacing the suspension and block method from the previous versions. Blocked threats during Static Analysis will no longer be suspended but denied execution completely.

- Real Time Protection's stability issues have now been fixed, it turns out the reason why the process was crashing wasn't within real time protection itself, but what it was calling, tlsh.dll. Looking at TLSH's open source code, under certain edge cases (empty reads, unexpected states, or concurrent calls), TLSH_Final/TLSH_GetHash could return an invalid state and crash. Our usage of TLSH wasn't optimal either so we’ve hardened this with strict guards (only finalize after data, null/length checks on the returned hash, defensive error handling) and made the code safe under heavy concurrency. This issue was already fixed since the 15th August, however we've decided to finish implementing and testing the new features below before release.

- For long term stability and best practices, Real Time Protection's Engine has been separated into multiple different processes, OmniDocumentsEngine, OmniExternalRules, OmniGradientBoostedEngine, OmniReputationEngine, OmniSRPEngine and OmniStaticRulesEngine.

Engine separation isolates any issues encountered when inferencing an unknown file to prevent any more cases with tlsh.dll. As processes are isolated from real time protection, unlike dynamic libraries which share the same memory as the host process calling it, meaning any issues within a dll could also take down the host process.

- As a result of Engine separation, Real Time Protection will now continue to run entirely in the background even if the main application is closed.

- Real Time Protection's generalization performance against unknown or variants of malware has been greatly improved by adding 3 new detection layers in OmniDefender for Malware Detection.

1. Policy Gate: Prohibits unknown or untrusted processes from high risk locations on the system
2. Static Rules: An always on rules engine that evaluates the PE feature set and extracted strings against a compact rule pack. Each rule expresses a clear condition. The engine flattens the features it needs, intersects tokens from the file with a curated dictionary, and counts combinations when several related atoms fire.
3. SRP Engine: A custom locality sensitive hashing (LSH) technique that turns high dimensional PE features into a few compact bit signatures so that similar files land close together (small Hamming distance) using Machine Learning which replaces TLSH.

We've also implemented a completely new detection method in addition to Real Time Protection.
OmniGuard is our Windows minifilter kernel mode behavior engine. It now continuously monitors processes, malicious commands ,and registry activity to block attacks and automatically backup files modified or deleted by an untrusted process.

What's new in Behavioral Analysis:

- Dynamic Ransomware Protection. Monitors the system for suspicious activity characteristic of ransomware; OmniGuard denies further writes and terminates the malicious offender. Events are raised for regular writes and even paging write flushes, so encryption runs can’t hide behind the cache.
- Automatic Backups Before Change. Before any edits, deletes, or overwrites, originals are backed up to a secure restore area for one click recovery in the UI.
- Boot MBR and GPT Safeguards. Blocks raw write attempts from untrusted processes to disks and volume roots, this prevents bootkits, MBR/GPT clobbers, and low-level tampers that could brick the system or erase recovery points.
- Process Burst and LOLBin Controls. Droppers and wipers often spawn a storm of children or hide behind built in Windows tools. OmniGuard watches the parent child chain and stops these bursts at the source. If an unknown process rapidly fans out or invokes high-risk Windows utilities with suspicious arguments or user writable targets, execution is cut, the tree is terminated, and a clear reason is logged for the incident view.
- Registry Protection: Registry Guard denies common malicious registry activity such as Run/RunOnce and legacy Load/Run, Explorer StartupApproved flips, Winlogon shell/userinit swaps, IFEO “Debugger” and SilentProcessExit chains, AeDebug redirection, AppInit_DLLs enable/set, protocol handler hijacks for http/https, per user COM InProcServer32 and PersistentHandler and much more.
- Malicious Command Protection: A command line gate that inspects creation time arguments and parent chains before processes run, then monitors early behavior to catch a wide variety of LOLBin abuse.

Real Time Protection UI features:
- Real Time Protection now only displays the "Active" State when all the engines are running. If any engines are terminated while real time protection is ON, it'll immediately turn OFF. This ensures Real Time Protection is only active when all its dependencies are active.
- New tab in Real Time Protection implemented named Incidents which displays all threats detected, date of detection, file name, full path, detection layer that was triggered and version information of the blocked threat.
- Status Indicators: Now displays 3 dynamic indicators on the top right of Real Time Protection, Static, Behavioral and System. Static references Static Analysis, Behavioral references the behavioral kernel and System references the system watcher. A green status implies that they're active and running. A red status indicates they failed to activate or have been terminated. A grey status indicates that they're OFF.
- OmniTray: Implements a tray for OmniDefender which allows you to check whether Real Time Protection is currently running without the main application. The tray also allows you to turn Real Time Protection ON or OFF directly.
- Ransomware Rollback (Experimental): Implemented an Emergency Recovery button which recovers files that have been modified, encrypted or deleted by unknown processes from the Behavioral Analysis kernel.
NOTE: Ransomware Rollback is an experimental feature and is still under development

Further updates will be released once a month or bi-monthly but heavily tested to guarantee functionality, stability and performance, opposing the fast, rushed release.

OmniDefender Version 1.5 will release on the 7th November 2025 and implement the following features but is not limited to:

- Fundamentally change Smart Scan similarly to Real Time Protection, which will aim to now scan the registry for malicious keys, enhance scanning speed, more interactive UI and significantly enhance detection performance.
- Analyze malicious non portable executable files heuristically such as documents, scripts and more
- Network Kernel Driver: A new driver aimed at monitoring malicious network activity will be added and block threats behaviorally
- Fixing CPU Performance page which fails to calculate the current CPU Temperature and Power in Real time, this feature is limited to Intel CPUs only for the time being.
- Fix any arising issues from the release of OmniDefender Version 1.4

Verification:

Installer SHA-256: d18326e4333151bea6ebbbba8e615d43328ec1fd59ba918c6324152eb69fd86d
OmniDefender.exe SHA-256: fdd02119bb7f4d2d62e935b707948ff7a343601d7a69d95e1da49b88cf6c6baa
Real Time Protection.dll SHA-256: 23019fdc486583518de2b613714b3acd57818ca6a4976248323640dfb5d08412

Drivers:
OmniGuard SHA-256: bd8df1ce66887c3bff2945f30182e216ce11bebf70d7a8207f43768ef97a5944
OmniGuardProcessGate SHA-256: 7c165775caf5096e96c84784fcc97b1acbd36216de4d964826faae0465dd9d3b
OmniWatcher SHA-256: 935738a534264ee5f81f694dc594b37e7acc4631cc49fc1c977a2bf15923e0a8


 
  • Like
Reactions: CyberDevil
There seems to be a lot of misunderstanding in this thread (intentional spite or not).

Hi,

I’ve developed and maintained a professional anti-malware solution in the past (later acquired along with its technologies, and I still continue its development internally for the company that acquired it). So I know firsthand what it really takes to build a serious security product.

At this stage, OmniDefender looks more like an AI demo than a true AV solution:

Real-Time Protection: instability and silent crashes are unacceptable. A real security engine must run in kernel mode with watchdog/recovery mechanisms to guarantee stability.
AI Custom Scan: this is not “cutting-edge AI” – it’s simply a large language model generating nice-looking explanations. Malware isn’t detected through prompts.
Privacy contradiction: claiming to be privacy-focused while your policy states that you collect all user-provided data undermines your credibility.
Design vs. substance: a polished UI doesn’t compensate for weak detection. In security, stability and detection rates always come before aesthetics.

Right now, OmniDefender feels more like a FakeAV boosted with ChatGPT than a next-gen solution. If you want to be taken seriously, you’ll need to:

  1. Prove bulletproof stability in real-time protection.
  2. Publish independent test results (AV-Test, AV-Comparatives, etc.).
  3. Demonstrate an actual detection engine beyond a dressed-up LLM explanation.
Until then, most professionals will see this as a marketing experiment rather than a cybersecurity product.

We've already mentioned that Version 1.4 will be worked on from early August. We've already received the same feedback on Version 1.3 so why continue testing the same version? Custom Scan's functionality has already been explained, it serves as an educational tool to help users learn of the potential of an unknown sample through static analysis. It has not, does not and will never serve as a malware detection method.

We collect user provided data only in the website, mainly from authentication and payment methods.

Our solution to this date is only 2 months old. While other are better solutions that may be younger or older, especially high end solutions that are around 8 years old to over 30 years old. That enormous age gap gives them more time to enhance their solution.

But we will simply continue to release updates for OmniDefender so that in the following years, our team will be large enough to compete with the largest solutions.

And a real engine, not something under Claude3, because even the oldest malware slips through undetected :D (tested with Brontok again tonight, even Virus.Zombie slips through and kills the VM....)

Another misunderstanding, OmniDefender does not integrate any LLM in it's detection engine.

Your Discord link is invalid...
Um, seriously, Facebook detection on your screen? o_O

Another misunderstanding. The link in the screen is hxxp://wwww-facebook.com and isn't the real facebook.

1759764309197.png


I wasn’t going to bring this up, but since we’re talking about credibility… According to official French company records, the founder of OmniDefender is legally registered as a food delivery courier (think Uber Eats), not as a cybersecurity professional or software developer.

So when you market yourself as an ‘AI-powered next-gen antivirus vendor’, but your official business activity is literally delivering meals by bike, it’s hard to take the project seriously.

Cybersecurity isn’t delivered on a bicycle. Building a real AV engine takes years of R&D, telemetry pipelines, kernel-level development, and proven results — not React dashboards glued on top of VirusTotal and GPT.

This isn’t professional cybersecurity, it’s a hobby project dressed up as something it isn’t.

Another misunderstanding, although you claim to have maintained a professional antivirus solution, you don't seem to understand what the french company records store about a company nor actually read my companies main activity. Avis de situation au répertoire Sirene - Insee is the official INSEE portal. It provides administrative identity and current status of all French companies. It displays the current status, SIRET of the head office, head office address, legal category and the main activity of the company. No where does it request or provide the qualifications (degree, certifications) of the owner. Have you actually created a company before @RoxasDev?

1759764322679.png


So I actually tested your “OmniDefender” setup in a VM (a 600 MB MSI 🤡). Thanks @Shadowra

Here’s what really happens:


  • Doesn’t even auto-launch after install, you have to manually start “real-time protection” from Program Files 🤦‍♂️
  • UI is just a laggy React/Electron wrapper, eating 90% CPU on every click
  • No kernel service, no memory scanning, no callbacks → RunPE / Process Hollowing = full party in RAM
  • Detection “engine” = hash lists + a LightGBM score that basically always says BENIGN
  • My test ransomware (non-obfuscated) was flagged BENIGN (AI), while Microsoft’s own VCRUNTIME DLL got flagged as MALWARE 😂
  • Everything runs entirely in admin-land user mode, nothing in Ring 0 → no kernel service, no real drivers

So yeah… this isn’t “Next-Gen Antivirus.”
It’s a 600 MB joke built on GitHub copy/paste and ChatGPT prompts.

Name fits better as OmniDefeated ☠️

Auto-launch is optional and not relevant. Nor do you need to start real time protection from program files. It seems you were intentionally avoiding the GUI for some reason. "No kernel service", another wrong statement. OmniDefender has 3 kernel drivers, including callbacks and memory scanning.

The detection engine in 1.4 has multiple layers. Digital Signature -> Signature Analysis -> Policy Gate -> Custom Static Rules -> External Rules (YARA) -> SRP Analysis (replaces TLSH) -> Gradient Boosted Anaylsis.

An unknown file may be flagged benign statically due to insufficient proof of maliciousness but will still be blocked behaviorally.

"Everything runs entirely in admin-land user mode", completely wrong. "ChatGPT Prompts", ChatGPT is unreliable when it comes to producing decent code but is excellent for research, we don't rely on ChatGPT's code, it produces endless errors and runtime issues. That should be obvious.

Yeah I managed to, but honestly it took an insane amount of time for… basically nothing in the end 😂
The “update” is just as useless as the rest of the program, felt more like watching paint dry than updating an AV.

Forgot to mention: if you click ‘Close’ in the main window, the whole thing just crashes 😂.

Automatic Updates sometimes fails due to multiple reasons, proxies, PAC, captive portals, slow links, antivirus SSL inspection, etc.

An “update” requires someone to actively work on expanding the detection logics.

When these detection logics are tangled with an ineffective platform (no kernel drivers, no behavioural blocking, no local/cloud emulation and so on), the update doesn’t matter.

An antivirus with no kernel drivers and exceptionally limited user mode visibility will:
-Barely detect any malware, when it does, it will be late and will use user-mode calls like NtTerminateProcess (which malware can easily resist).
-It will be wrecked by malware due to lack of self-protection
-This architecture is a step above command line scanner, the only difference is the addition of GUI.

Such product is not security software, it is a placebo.

It combines bugs (silent crashes, racing conditions), with architecture that is by no means suitable for the job (unfit for the purpose) and creates a false sense of security. The addition of Claude/LLMs is there to evoke a sense of technical sophistication, whilst the underlying code is a joke.

To get to the “Next-Gen” you first have to perfect the “Current-Gen”.

Updates of the database are pushed to the website regularly, which automatic updates retrieves.

"An antivirus with no kernel drivers", it's unfortunate to see that no one has actually bothered to check.
"Barely detect any malware", another big misunderstanding, our priority on release was not a high detection rate on Version 1.0, but stability and functionality. Performance is worked on after everything else is deemed functional which takes time.

Bugs are common in complex software, especially during the first year of release. That's why patch notes exist and are provided to fix and enhance
View attachment 290549

It detected Edge as malware LOL :ROFLMAO:

Well, now you're protected :D

View attachment 290550

The structure of elevation services are quite common in malware that attempt privilege escalation attacks. Which is why elevation_service.exe was flagged. This is still a false positive and will be worked on.
Exactly.

AI is just one layer in the stack, useful for obscure patterns or unknown samples, but it’s always controlled by:
  • Heuristics from real analysis → the engine applies strict rules from reverse-engineering experience.
  • Cloud whitelist → massive collections of trusted files to avoid “Adobe = trojan” type of nonsense.
  • Scoring system → AI output is just a coefficient, not the final verdict. The decision is made by combining AI + heuristics + file reputation.
Otherwise, you get what we see with OmniDefender: AI run wild, labeling Edge as an APT and Acrobat as a trojan, while missing actual ransomware.

OmniDefender also has a scoring system, whitelist and heuristics. However the thresholds are still being fine tuned to minimize false positives.


Yes exactly. Signature verification and safe program regex are evaluated first. AI is just an additional signal, never the final judge. If a file is signed with a trusted cert (like MS Class 3) or matches known safe binaries, it bypasses AI scoring completely. Otherwise you end up with the OmniDefender circus 🤡.

Signature Verification is also a part OmniDefender's detection engine, however they were not fully impletented in Version 1.3.
 
There seems to be a lot of misunderstanding in this thread (intentional spite or not).



We've already mentioned that Version 1.4 will be worked on from early August. We've already received the same feedback on Version 1.3 so why continue testing the same version? Custom Scan's functionality has already been explained, it serves as an educational tool to help users learn of the potential of an unknown sample through static analysis. It has not, does not and will never serve as a malware detection method.

We collect user provided data only in the website, mainly from authentication and payment methods.

Our solution to this date is only 2 months old. While other are better solutions that may be younger or older, especially high end solutions that are around 8 years old to over 30 years old. That enormous age gap gives them more time to enhance their solution.

But we will simply continue to release updates for OmniDefender so that in the following years, our team will be large enough to compete with the largest solutions.



Another misunderstanding, OmniDefender does not integrate any LLM in it's detection engine.



Another misunderstanding. The link in the screen is hxxp://wwww-facebook.com and isn't the real facebook.

View attachment 291625



Another misunderstanding, although you claim to have maintained a professional antivirus solution, you don't seem to understand what the french company records store about a company nor actually read my companies main activity. Avis de situation au répertoire Sirene - Insee is the official INSEE portal. It provides administrative identity and current status of all French companies. It displays the current status, SIRET of the head office, head office address, legal category and the main activity of the company. No where does it request or provide the qualifications (degree, certifications) of the owner. Have you actually created a company before @RoxasDev?

View attachment 291626



Auto-launch is optional and not relevant. Nor do you need to start real time protection from program files. It seems you were intentionally avoiding the GUI for some reason. "No kernel service", another wrong statement. OmniDefender has 3 kernel drivers, including callbacks and memory scanning.

The detection engine in 1.4 has multiple layers. Digital Signature -> Signature Analysis -> Policy Gate -> Custom Static Rules -> External Rules (YARA) -> SRP Analysis (replaces TLSH) -> Gradient Boosted Anaylsis.

An unknown file may be flagged benign statically due to insufficient proof of maliciousness but will still be blocked behaviorally.

"Everything runs entirely in admin-land user mode", completely wrong. "ChatGPT Prompts", ChatGPT is unreliable when it comes to producing decent code but is excellent for research, we don't rely on ChatGPT's code, it produces endless errors and runtime issues. That should be obvious.



Automatic Updates sometimes fails due to multiple reasons, proxies, PAC, captive portals, slow links, antivirus SSL inspection, etc.



Updates of the database are pushed to the website regularly, which automatic updates retrieves.

"An antivirus with no kernel drivers", it's unfortunate to see that no one has actually bothered to check.
"Barely detect any malware", another big misunderstanding, our priority on release was not a high detection rate on Version 1.0, but stability and functionality. Performance is worked on after everything else is deemed functional which takes time.

Bugs are common in complex software, especially during the first year of release. That's why patch notes exist and are provided to fix and enhance


The structure of elevation services are quite common in malware that attempt privilege escalation attacks. Which is why elevation_service.exe was flagged. This is still a false positive and will be worked on.


OmniDefender also has a scoring system, whitelist and heuristics. However the thresholds are still being fine tuned to minimize false positives.




Signature Verification is also a part OmniDefender's detection engine, however they were not fully impletented in Version 1.3.

If you’re going to respond, at least try to do it without proving my point in real time.

You keep repeating “misunderstanding” as if the problem is comprehension, not competence. It’s not that people misunderstand you — it’s that what you’re describing simply doesn’t exist beyond your imagination.

Let’s recap:
  • A two-month-old hobby project with a laggy Electron shell, no credible driver stack, and a “gradient-boosted” buzzword salad isn’t a security engine.
  • Throwing acronyms like YARA, SRP, and TLSH doesn’t make you a malware analyst. It just shows you’ve spent too much time on GitHub scraping other people’s code.
  • “We’ll improve over the years” is not a development roadmap. It’s an admission that right now, OmniDefender is unfinished, unstable, and unfit for purpose.
And please — stop hiding behind INSEE definitions. Nobody cares whether your registration line says “food delivery” or “quantum cybersecurity startup.” What matters is that your product behaves like the former and pretends to be the latter.

Real security software isn’t built on PowerPoint slides and marketing buzzwords. It’s built on kernel stability, telemetry infrastructure, and a proven ability to stop real threats — none of which OmniDefender currently demonstrates.

You can keep trying to argue semantics, but as long as your software keeps crashing, flagging Edge as malware, and missing decade-old viruses, no amount of “gradient boosting” is going to change the verdict.

You don’t need better PR.
You need an actual engine.
 
If you’re going to respond, at least try to do it without proving my point in real time.

You keep repeating “misunderstanding” as if the problem is comprehension, not competence. It’s not that people misunderstand you — it’s that what you’re describing simply doesn’t exist beyond your imagination.

Let’s recap:
  • A two-month-old hobby project with a laggy Electron shell, no credible driver stack, and a “gradient-boosted” buzzword salad isn’t a security engine.
  • Throwing acronyms like YARA, SRP, and TLSH doesn’t make you a malware analyst. It just shows you’ve spent too much time on GitHub scraping other people’s code.
  • “We’ll improve over the years” is not a development roadmap. It’s an admission that right now, OmniDefender is unfinished, unstable, and unfit for purpose.
And please — stop hiding behind INSEE definitions. Nobody cares whether your registration line says “food delivery” or “quantum cybersecurity startup.” What matters is that your product behaves like the former and pretends to be the latter.

Real security software isn’t built on PowerPoint slides and marketing buzzwords. It’s built on kernel stability, telemetry infrastructure, and a proven ability to stop real threats — none of which OmniDefender currently demonstrates.

You can keep trying to argue semantics, but as long as your software keeps crashing, flagging Edge as malware, and missing decade-old viruses, no amount of “gradient boosting” is going to change the verdict.

You don’t need better PR.
You need an actual engine.

Seems like your replies themselves are AI generated.

If you're going to critique, at least provide context and actually write yourself. Right now "laggy electron shell" definitely shows you're just copy pasting from ChatGPT. Not once have I ever mentioned that OmniDefender was made with electron, yet you're telling me the issue isn't comprehension when you still haven't haven't understood OmniDefender's framework. Where's the context for "No credible driver stack"?
"Gradient-Boosted" isn't a buzzword. "Machine Learning" and "AI" are more likely to be used as buzzwords.

You're assuming I've been scraping github for other people's code, where did this even come from? Even if it was true, isn't the goal of open-source code meant for shared contribution and inspiration? By your logic I'm forbidden from learning and being inspired from ClamAV's functionality and code practices?

"“We’ll improve over the years” is not a development roadmap".
Well of course it's not a roadmap, a roadmap provides a forecast of what new features will be implemented at what time.

"Real security software isn’t built on PowerPoint slides" ????

"software keeps crashing, flagging Edge as malware, and missing decade-old viruses, no amount of “gradient boosting” is going to change the verdict."
All these were tested on an 8 day old antivirus whose immediate focus wasn't on pure performance but functionality and stability.

"two-month-old hobby project", do you actually have a relevant or a credible career to assume that a software released 2 months ago would also simultaneously have 2 months of development pre-release?
 
  • Applause
Reactions: ChoiceVoice
Seems like your replies themselves are AI generated.

If you're going to critique, at least provide context and actually write yourself. Right now "laggy electron shell" definitely shows you're just copy pasting from ChatGPT. Not once have I ever mentioned that OmniDefender was made with electron, yet you're telling me the issue isn't comprehension when you still haven't haven't understood OmniDefender's framework. Where's the context for "No credible driver stack"?
"Gradient-Boosted" isn't a buzzword. "Machine Learning" and "AI" are more likely to be used as buzzwords.

You're assuming I've been scraping github for other people's code, where did this even come from? Even if it was true, isn't the goal of open-source code meant for shared contribution and inspiration? By your logic I'm forbidden from learning and being inspired from ClamAV's functionality and code practices?

"“We’ll improve over the years” is not a development roadmap".
Well of course it's not a roadmap, a roadmap provides a forecast of what new features will be implemented at what time.

"Real security software isn’t built on PowerPoint slides" ????

"software keeps crashing, flagging Edge as malware, and missing decade-old viruses, no amount of “gradient boosting” is going to change the verdict."
All these were tested on an 8 day old antivirus whose immediate focus wasn't on pure performance but functionality and stability.

"two-month-old hobby project", do you actually have a relevant or a credible career to assume that a software released 2 months ago would also simultaneously have 2 months of development pre-release?

Everything that needed to be said is already in this thread.
Just read it carefully the evidence speaks for itself.
 
Seems like your replies themselves are AI generated.

If you're going to critique, at least provide context and actually write yourself. Right now "laggy electron shell" definitely shows you're just copy pasting from ChatGPT. Not once have I ever mentioned that OmniDefender was made with electron, yet you're telling me the issue isn't comprehension when you still haven't haven't understood OmniDefender's framework. Where's the context for "No credible driver stack"?
"Gradient-Boosted" isn't a buzzword. "Machine Learning" and "AI" are more likely to be used as buzzwords.

You're assuming I've been scraping github for other people's code, where did this even come from? Even if it was true, isn't the goal of open-source code meant for shared contribution and inspiration? By your logic I'm forbidden from learning and being inspired from ClamAV's functionality and code practices?

"“We’ll improve over the years” is not a development roadmap".
Well of course it's not a roadmap, a roadmap provides a forecast of what new features will be implemented at what time.

"Real security software isn’t built on PowerPoint slides" ????

"software keeps crashing, flagging Edge as malware, and missing decade-old viruses, no amount of “gradient boosting” is going to change the verdict."
All these were tested on an 8 day old antivirus whose immediate focus wasn't on pure performance but functionality and stability.

"two-month-old hobby project", do you actually have a relevant or a credible career to assume that a software released 2 months ago would also simultaneously have 2 months of development pre-release?
Which driver terminates viruses? Because Zemana get abused by this way.
 
@OsirisXD

Another misunderstanding, OmniDefender does not integrate any LLM in it's detection engine.

So if you don't have an LLM engine or anything else, how do you create the detections? (the ones I mentioned)
Let me clarify, I'm not here to kill your project, just to understand and test it.

In fact, I've already done so on a fresh VM: Your resident protection doesn't work for me...
It's impossible to test it, even after rebooting the machine. Your agents crash after about 30 seconds, when your service reaches 100% CPU usage.

Capture d’écran 2025-10-06 211412.png
Capture d’écran 2025-10-06 211500.png
 
@OsirisXD



So if you don't have an LLM engine or anything else, how do you create the detections? (the ones I mentioned)
Let me clarify, I'm not here to kill your project, just to understand and test it.

In fact, I've already done so on a fresh VM: Your resident protection doesn't work for me...
It's impossible to test it, even after rebooting the machine. Your agents crash after about 30 seconds, when your service reaches 100% CPU usage.


That’s exactly why I said earlier this thing is built with React/Electron it’s ridiculously heavy and unstable.
Those frameworks were never meant to power an antivirus, but hey… apparently I’m the one “using ChatGPT to write my replies,” right? 😂
 
That’s exactly why I said earlier this thing is built with React/Electron it’s ridiculously heavy and unstable.
Those frameworks were never meant to power an antivirus, but hey… apparently I’m the one “using ChatGPT to write my replies,” right? 😂
I use React too in some of my projects (though I don’t discard vue js and Angular either). But this is just the user interaction… besides the interaction there are many other important points to take care of.
 
Last edited:
I use React too in some of my projects (though I don’t discard vue js and Angle either). But this is just the user interaction… besides the interaction there are many other important points to take care of.

Yeah, React is great for building clean, lightweight user interfaces but for an antivirus interface, it’s completely the wrong framework for the job.
 
@OsirisXD



So if you don't have an LLM engine or anything else, how do you create the detections? (the ones I mentioned)
Let me clarify, I'm not here to kill your project, just to understand and test it.

In fact, I've already done so on a fresh VM: Your resident protection doesn't work for me...
It's impossible to test it, even after rebooting the machine. Your agents crash after about 30 seconds, when your service reaches 100% CPU usage.


Honestly I might consider reverting to a beta version and remove the paid versions and make OmniDefender completely free and continue enhancing it for the distant future until it's safe and good enough to compete with other larger solutions. My goal wasn't to monetize this project immediately anyway but receive valuable feedback like yours to continue enhancing it, nor was it to get this much hate.

If you're wondering why there's such a CPU spike when starting OmniDefender, its mainly because several engines are being started simultaneously. Are you still able to start real time protection?
 
Honestly I might consider reverting to a beta version and remove the paid versions and make OmniDefender completely free and continue enhancing it for the distant future until it's safe and good enough to compete with other larger solutions. My goal wasn't to monetize this project immediately anyway but receive valuable feedback like yours to continue enhancing it, nor was it to get this much hate.

If you're wondering why there's such a CPU spike when starting OmniDefender, its mainly because several engines are being started simultaneously. Are you still able to start real time protection?

Your interface is far too heavy every single click in the UI sends the CPU straight to 100%.
The framework you’re using for the interface isn’t optimized for this kind of application.
If you want something lightweight and stable, build your UI in .NET, like Kaspersky, Malwarebytes, and other professional AVs do and keep your protection modules in C++.