POLAR ANTIVIRUS FREE (Updates)

tiktoshi

tiktoshi

Level 6
Thread author
Verified
Well-known
Forum Veteran
Jan 19, 2015
284
1,559
469
41
Algeria
forum.zyzoom.net

This is not a commercial version; it's my own version that I'm sharing with you. The POLAR ANTIVIRUS program was created using ai and some modifications I made to it.​

Features at a Glance​

  • ⚡ Real-Time Protection: Background monitoring of every process and file creation to stop threats before they act. Without an Ikarus engine
  • 🔥 Smart Firewall: Monitor and control network traffic with ease, protecting your system from unauthorized access.
  • 🌏 Blocking malicious IP: Protection against harmful and untrusted IP addresses
  • ☁️ Cloud Intelligence: Integration with VirusTotal and Kaspersky Threat Intelligence Portal API for secondary, high-confidence file analysis.
  • 📂 Quarantine System: Safely isolate suspicious files without deleting them, giving you full control.
  • 📋 Detailed Logs: Comprehensive history of scans and detections to keep you informed.
Project: Release POLAR ANTIVIRUS · tiktoshi40-netizen/polupdate .

Download https://github.com/tiktoshi40-netizen/polupdate/releases/download/latest/PolarInstaller_6.0.4.exe

VirusTotal

VirusTotal
www.virustotal.com www.virustotal.com


联想截图_20260609231630.png



联想截图_20260610004730.png

3b079490-e4d1-42b1-ad79-e42937a1b411.png


Important Note:
This application is not a replacement for your primary antivirus software!Use it in addition to your main antivirus program (Kaspersky, ESET, Norton, etc.)
for enhanced protection.Designed to work alongside primary antivirus programs such as Kaspersky, ESET, Norton, and others.Why do you need it?Additional Scan: Get a second opinion from 8+ engines via VirusTotalAdvanced Detection: POLAR engine for suspicious files that primary antivirus programs might missAn extra layer of certified protectionSafe to use: Does not conflict with existing antivirus programs

You need to obtain an API key from VirusTotal or Kaspersky Threat Intelligence Portal (free or paid).To avoid conflicts: If you have another antivirus program installed on your computer (such as Kaspersky), you can disable it from the Polar menu to prevent code conflicts.
 
Last edited:
  • Like
  • Thanks
  • +Reputation
Reactions: Dani Santos, Brownie2019, Amnesia and 12 others
Harputlu said:
Which antivirus engine does Polar Protection use? ikarus ???
Click to expand...
Signature-based Detection:The engine calculates a digital "fingerprint" (MD5 hash) for each scanned file.This fingerprint is then compared to a database.Pe Section Scanning:The engine doesn't just scan the file as a whole; it also decompiles executable files (EXE/DLL) and scans their internal partitions.This helps detect viruses even if the original file size or a small part of it has been modified.
The ikarus engine is not used
 
  • Like
Reactions: Brownie2019, Khushal, stonjean633 and 5 others
tiktoshi said:

This is not a commercial version; it's my own version that I'm sharing with you. The POLAR ANTIVIRUS program was created using ai and some modifications I made to it.​

Features at a Glance​

  • ⚡ Real-Time Protection: Background monitoring of every process and file creation to stop threats before they act. Without an Ikarus engine
  • 🌐 Web Shield: Advanced URL filtering and safe browsing powered by a custom proxy to block malicious websites.
  • 🔥 Smart Firewall: Monitor and control network traffic with ease, protecting your system from unauthorized access.
  • ☁️ Cloud Intelligence: Integration with VirusTotal API for secondary, high-confidence file analysis.
  • 📂 Quarantine System: Safely isolate suspicious files without deleting them, giving you full control.
  • 📋 Detailed Logs: Comprehensive history of scans and detections to keep you informed.
project Release POLAR ANTIVIRUS · tiktoshi40-netizen/polupdate .

Setup file https://github.com/tiktoshi40-netiz...ownload/POLARANTIVIRUS/PolarInstaller_5.7.exe .
VirusTotal

View attachment 293884
Click to expand...

Interesting! If it is legit this time it is a little gem.

About the "local DNS filtering", how does that work?
 
  • Like
  • Applause
Reactions: Brownie2019, Dave Russo, Khushal and 2 others
pxxb1 said:
Interesting! If it is legit this time it is a little gem.

About the "local DNS filtering", how does that work?
Click to expand...
Local DNS filtering in Polar is a proactive layer of protection that operates at the network level before any data is actually loaded from your browser.

Your device is transformed into a local DNS server. The Polar application creates a small DNS server running on your device's port (Port 53). The software then modifies Windows settings (via WMI) to set the website search address to 127.0.0.1 (your own device).

The Polar server retrieves the domain name and immediately compares it to a local database of blocked sites.

If the site is malicious, the server immediately responds with a fake IP address (0.0.0.0) (isolation). Your browser will display a "Site Not Found" message, and no actual internet connection request will be sent, preventing even a connection attempt.

If the site is legitimate, the server sends the request to a fast and secure external provider (such as Cloudflare 1.1.1.1) to obtain the correct IP address and then forwards it to you. It protects "everything" on the device (applications, games, background processes) because it operates at the operating system level.

Local IP address rules (blocked_ips) (blocked_sites) work similarly to website rules but with a greater emphasis on the firewall:

IP rules: Known malicious IP addresses are stored in blocked_ips.bin files.
Dynamic blocking: If the system blocks a specific website (such as bad-site.com), it automatically retrieves its IP address and blocks it in the firewall to ensure viruses cannot connect to the server directly via that IP.
 
  • Like
Reactions: simmerskool, Khushal, stonjean633 and 1 other person
I played around with it a bit, and yes, it no longer uses Ikarus. It has VirusTotal and its own engine (it downloads its definitions via GitHub).

Here is its interface.

1.png
2.png
3.png
4.png

VirusTotal is clearly indicated with the choice of “engines” used (Kaspersky, Avast, etc.), somewhat like Secureaplus/CatchPulse.
Note that the antivirus does not provide the API key; you will have to enter it yourself (unfortunately, it does not indicate that one is required or how to do so).

5.png

The Polar engine (very little configuration and, above all, extremely poor detection rates on a pack dating back a week...)

6.png
9.png

Otherwise, its main feature is VirusTotal (still like CatchPulse/Secureaplus).

7.png
8.png

Surprisingly, when it moves to Quarantine, it only moves. Except that a script can restart the targeted infection because the files are not locked or encrypted.
BIG SECURITY CONCERNS HERE !
10.png

The firewall and web protection are useless; there was no reaction to a ConnectWise I installed.
And if Polar DB and VirusTotal don't recognize a sample, the antivirus lets it pass completely because there is no proactive system (tested with a NanoCore RAT that I built for the test—the connection was made between my VM and another VM with a VPN on it).

On a small piece of malware that I quickly made in Batch with a simple Taskkill command, the antivirus shuts down too easily... I don't dare imagine what would happen with a worm...
There's still work to be done!
 
  • Like
  • Thanks
  • Hundred Points
Reactions: Brownie2019, pvsurfer, Sorrento and 10 others
Shadowra said:
I played around with it a bit, and yes, it no longer uses Ikarus. It has VirusTotal and its own engine (it downloads its definitions via GitHub).

Here is its interface.

View attachment 293887View attachment 293888View attachment 293889View attachment 293890

VirusTotal is clearly indicated with the choice of “engines” used (Kaspersky, Avast, etc.), somewhat like Secureaplus/CatchPulse.
Note that the antivirus does not provide the API key; you will have to enter it yourself (unfortunately, it does not indicate that one is required or how to do so).

View attachment 293891

The Polar engine (very little configuration and, above all, extremely poor detection rates on a pack dating back a week...)

View attachment 293892View attachment 293895

Otherwise, its main feature is VirusTotal (still like CatchPulse/Secureaplus).

View attachment 293893View attachment 293894

Surprisingly, when it moves to Quarantine, it only moves. Except that a script can restart the targeted infection because the files are not locked or encrypted.
BIG SECURITY CONCERNS HERE !
View attachment 293896

The firewall and web protection are useless; there was no reaction to a ConnectWise I installed.
And if Polar DB and VirusTotal don't recognize a sample, the antivirus lets it pass completely because there is no proactive system (tested with a NanoCore RAT that I built for the test—the connection was made between my VM and another VM with a VPN on it).

On a small piece of malware that I quickly made in Batch with a simple Taskkill command, the antivirus shuts down too easily... I don't dare imagine what would happen with a worm...
There's still work to be done!
Click to expand...
very basic protection that looks good only on surface.
 
  • Like
  • Hundred Points
  • +Reputation
Reactions: Brownie2019, simmerskool, stonjean633 and 4 others
Shadowra said:
I played around with it a bit, and yes, it no longer uses Ikarus. It has VirusTotal and its own engine (it downloads its definitions via GitHub).

Here is its interface.

View attachment 293887View attachment 293888View attachment 293889View attachment 293890

VirusTotal is clearly indicated with the choice of “engines” used (Kaspersky, Avast, etc.), somewhat like Secureaplus/CatchPulse.
Note that the antivirus does not provide the API key; you will have to enter it yourself (unfortunately, it does not indicate that one is required or how to do so).

View attachment 293891

The Polar engine (very little configuration and, above all, extremely poor detection rates on a pack dating back a week...)

View attachment 293892View attachment 293895

Otherwise, its main feature is VirusTotal (still like CatchPulse/Secureaplus).

View attachment 293893View attachment 293894

Surprisingly, when it moves to Quarantine, it only moves. Except that a script can restart the targeted infection because the files are not locked or encrypted.
BIG SECURITY CONCERNS HERE !
View attachment 293896

The firewall and web protection are useless; there was no reaction to a ConnectWise I installed.
And if Polar DB and VirusTotal don't recognize a sample, the antivirus lets it pass completely because there is no proactive system (tested with a NanoCore RAT that I built for the test—the connection was made between my VM and another VM with a VPN on it).

On a small piece of malware that I quickly made in Batch with a simple Taskkill command, the antivirus shuts down too easily... I don't dare imagine what would happen with a worm...
There's still work to be done!
Click to expand...
Encryption without locking or extension changes.

Check the hash before and after quarantine. I will add extension changes during isolation. The Polar engine is very simple; over time, the database is fed accurate detections to prevent false positives. Killing the process is very easy to avoid any problems or system crashes. I will add explanatory text on using VirusTotal keys. Thank you, brother, for your efforts.
:love:
 
  • Like
  • Thanks
  • Applause
Reactions: Brownie2019, Gandalf_The_Grey, stonjean633 and 6 others
tiktoshi said:
Local DNS filtering in Polar is a proactive layer of protection that operates at the network level before any data is actually loaded from your browser.

Your device is transformed into a local DNS server. The Polar application creates a small DNS server running on your device's port (Port 53). The software then modifies Windows settings (via WMI) to set the website search address to 127.0.0.1 (your own device).

The Polar server retrieves the domain name and immediately compares it to a local database of blocked sites.

If the site is malicious, the server immediately responds with a fake IP address (0.0.0.0) (isolation). Your browser will display a "Site Not Found" message, and no actual internet connection request will be sent, preventing even a connection attempt.

If the site is legitimate, the server sends the request to a fast and secure external provider (such as Cloudflare 1.1.1.1) to obtain the correct IP address and then forwards it to you. It protects "everything" on the device (applications, games, background processes) because it operates at the operating system level.

Local IP address rules (blocked_ips) (blocked_sites) work similarly to website rules but with a greater emphasis on the firewall:

IP rules: Known malicious IP addresses are stored in blocked_ips.bin files.
Dynamic blocking: If the system blocks a specific website (such as bad-site.com), it automatically retrieves its IP address and blocks it in the firewall to ensure viruses cannot connect to the server directly via that IP.
Click to expand...

Ok.

So which DNS database does it use, Safe DNS?
 
  • Like
Reactions: Sorrento, Khushal, tiktoshi and 2 others
Hi @tiktoshi

You are back again nice. I have some questions for you

1. Any plans for the multilanguage Version available when yes then will it comes

2. How can I submit samples to you

3. Will you add the polar engine to virustotal

4. On which Windows Versions did it work

5. What are your plans roadmap for the product

6. Is it legal now

Mops21
 
  • Like
Reactions: Brownie2019, Sorrento, simmerskool and 4 others
Mops21 said:
Hi @tiktoshi

You are back again nice. I have some questions for you

1. Any plans for the multilanguage Version available when yes then will it comes

2. How can I submit samples to you

3. Will you add the polar engine to virustotal

4. On which Windows Versions did it work

5. What are your plans roadmap for the product

6. Is it legal now

Mops21
Click to expand...
There is nothing we are planning
 
  • Like
Reactions: Sorrento, stonjean633 and Khushal

You may also like...