AI Malware Scanner
Guide 12 steps · about 10 minutes to read

How to use AI Malware Scanner

A visual, step-by-step guide: from download to a clean computer, with a screenshot for every step.

  1. 1Install
  2. 2Connect the assistant
  3. 3Check this computer
  4. 4Follow the triage
  5. 5Read the results
  6. 6Ask questions
  7. 7Approve the plan
  8. 8See what changed
  9. 9Manage findings
  10. 10Run actions yourself
  11. 11Quarantine
  12. 12Report & log

Download and install

Download the installer, then install it like any other app.

Download AI Malware Scanner

macOS

  1. Open the downloaded .dmg file.
  2. Drag AI Malware Scanner into Applications.
  3. Start it from Applications or Launchpad.

Windows

  1. Run the -setup.exe installer.
  2. Choose an install folder, or keep the default.
  3. Start it from the Start menu or the desktop shortcut.

Linux

  1. AppImage: make it executable (chmod +x) and run it.
  2. Debian/Ubuntu: sudo apt install ./AI-Malware-Scanner-*.deb

Early preview builds are not yet signed by Apple or Microsoft.

On macOS, if you see “cannot be verified”, open System Settings → Privacy & Security and click Open Anyway. On Windows, if SmartScreen appears, click More info → Run anyway.

Connect the AI assistant (optional)

Open Settings at the bottom left of the window.

  • Enter the gateway URL and your API key. The key is stored in your operating system’s keychain and is never shown again.
  • Choose how much data is shared with the gateway. Minimal is recommended: no file contents, documents, history or passwords, and user names masked.
  • Allow or block web research, and pick your language and default detail level.
  • Click Test connection to check that the key and model work.

No API key? You can skip this step. Scanning and detection work fully without the AI. The assistant then runs in playbook mode and proposes next steps from the intelligence pack.

Click “Check this computer”

The home screen shows that everything is ready, and starts a check with one click.

Intelligence pack

The detection rules and knowledge in use. The signature must say Valid.

AI assistant

Gateway, key and privacy settings at a glance, with a connection test.

This computer

Your system, your privileges, built-in security products and the scan engines found.

On macOS, the home screen may say some checks need Full Disk Access. Grant it in System Settings → Privacy & Security → Full Disk Access for the most complete results.

Follow the triage scan

A new session opens and the read-only triage starts. It typically takes a few minutes. You can keep using your computer.

  • ✓ done
  • ◐ in progress
  • ○ waiting
  • – skipped

Use Pause or Cancel if you need to. Partial results are always kept. Findings appear in the Findings panel on the right as soon as they are found.

Read the summary and the findings

When the triage is done, the assistant tells you in plain language what it found, starting with what matters most.

Summary

How long the check took, how many things are worth a look, and the most serious ones first.

Finding cards

What it is, why it matters and what to do, plus which checks found it and how confident the scanner is.

Findings panel

Every finding of the session, sorted by severity. Click one to jump to it in the conversation.

  • Critical act now
  • High likely a real problem
  • Medium worth a closer look
  • Low minor or probably fine
  • Info for your information

Ask questions

Type any question in the box at the bottom, such as “What is this process?” or “Is my data at risk?”. Press Enter to send, or Shift+Enter for a new line.

  • Intelligence pack curated, signed knowledge
  • AI gateway the AI assistant
  • Web web research, with links
  • System the app itself

Click a suggested reply under the answer to continue in one click. Change the Detail level at the top: Guided keeps it simple, Standard shows more, and Expert adds raw evidence and technical details.

Review and approve the plan

The assistant proposes a plan: usually read-only checks first, then the fixes. Each step shows what it does, why, how long it takes and, for changes, exactly what will change.

  • Read-only only reads information
  • Changes system reversible, asks for confirmation
  • Destructive hard to undo, asks twice

Approve runs a step, Edit lets you change its parameters (they are checked again), and Skip leaves it out. Approve all approves the whole plan, but every change still asks for its own confirmation:

Confirm change

Quarantine file

Move “/Users/sam/Library/Application Support/.syncd/syncd-helper” into the encrypted quarantine. The file will no longer be at its current location until you restore it.

CancelMake this change

The system dialog that appears for every change. The AI can’t answer it for you.

See what changed

Each approved step reports back in the conversation with its result. When the plan is done, the assistant sums up and suggests what to look at next.

The finding’s status changes to Remediated. Any new findings discovered along the way are listed in the result card; click one to open it in the findings panel.

Manage your findings

The findings panel keeps every finding of the session in one place.

Filter

Show only certain severities, statuses or types of finding.

Details

Expand a finding for the full explanation, the detection sources and the MITRE ATT&CK techniques.

Your verdict

Mark as false positive or Accept risk. Keep Remember for future sessions on so it won’t be raised again.

Run actions yourself

Want to scan a specific folder or inspect a process? Click Actions or press ⌘K on a Mac, Ctrl+K on Windows and Linux.

Search or browse by category, pick an action, fill in the form and click Run. The result appears in the conversation, and the same validation and confirmations apply as for the assistant’s proposals.

Restore or delete from quarantine

Click Quarantine at the bottom left to see every file the scanner has locked away.

Restore… puts a file back exactly where it was. Delete… removes the encrypted copy for good, and asks you twice. Both need an open session, so the action is recorded in its log.

Export a report and review the log

Everything that happened in a session is on the record, ready to keep or share with whoever helps you.

Log

The Audit trail of every proposal, approval and action, verified by a hash chain, and the Web searches made.

Export → Session report

The session report as a PDF, or as JSON for other tools. The conversation can also be exported as a transcript.

Export → Evidence package

A ZIP with hashes, metadata and logs and a SHA-256 manifest, for an expert. Copies of suspicious files only if you ask.

Handy to know

  • Sessions are listed on the left. Hover over one to rename (✎), archive (⇩) or delete it; click to resume where you left off.
  • Stop at the top interrupts the assistant at any time.
  • Without the AI gateway, the session shows Playbook mode: detection is unaffected, and next steps come from the intelligence pack.
  • Light or dark mode follows your system settings.
⌘K / Ctrl+KOpen the action palette
EnterSend your message
Shift+EnterNew line in your message
EscClose a dialog

Ready? Check your computer now.

Download AI Malware Scanner and run your first check in a few minutes. Nothing changes without your approval.

Download AI Malware Scanner Back to the overview

Version 0.1.0 · early preview