AVRunner

A KDE Plasma 6 application for scanning Windows drives for malware using one or more external antivirus scanners.

AVRunner is specialised software designed for use on dedicated malware-scanning distributions (such as c't Desinfect). It relies on specific properties of the host environment:

• No automatic mounting of NTFS/FAT partitions — the host must not auto-mount Windows volumes so that AVRunner can mount them read-only.
• Installed and licensed scanners — each scanner (ClamAV, ESET, IKARUS, WithSecure) must be installed and properly licensed on the host system.
• KDE Plasma desktop — used for Polkit authentication dialogs, screen-saver inhibition, and the overall look and feel.
• fanotify / CAP_SYS_ADMIN — the avrunner-filemon helper requires cap_sys_admin to track scanner file access for progress reporting.
• Root-capable mount helpers — partition mounting and scanner privilege escalation use pkexec with a Polkit policy and the avrunner-run-as-root whitelist wrapper.

Features

• One tab per scanner with independent controls, log output, and progress tracking.
• Scan progress via fanotify — real-time file-access counting for all scanners, including client-server architectures like ESET.
• Windows drive support — detects and mounts NTFS, exFAT, and FAT32/VFAT partitions read-only. BitLocker-encrypted volumes are supported via dislocker with recovery key or user password.
• Consolidated findings — all scanner results merged into one table with SHA-256 hashes, file sizes, and an exportable HTML report. Duplicate files (same hash) are highlighted.
• Scan All & Shut Down — unattended overnight scanning: runs all scanners, saves the HTML report to the data partition (DESINFECT_D), and shuts down the system with a cancellable 30-second countdown.
• Headless/CLI mode — avrunner --headless for scripted or unattended scans with JSON, plain-text, or HTML report output.
• Scan options — archives, PUA detection, max file size, and more, applied consistently across all scanners (including ESET via seteset).
• Screen-saver inhibition — prevents the screen from blanking during long scans (freedesktop ScreenSaver D-Bus interface).
• Resource monitoring — warns when disk space or memory runs low.
• Fuzzy path matching — compensates for scanners (e.g. IKARUS) that strip non-ASCII characters from file paths, enabling SHA-256 hash computation even for files in directories with umlauts.

Quick Start

# Build
sudo apt install cmake ninja-build g++ \
    qt6-base-dev qt6-base-dev-tools \
    libkf6coreaddons-dev libkf6config-dev \
    libkf6widgetsaddons-dev libkf6xmlgui-dev \
    libkf6i18n-dev libkf6kio-dev libkf6service-dev \
    extra-cmake-modules

cmake -B build -DCMAKE_BUILD_TYPE=RelWithDebInfo -G Ninja
cmake --build build --parallel

# Run
./build/bin/avrunner

License

GPL v3 or later.