A small, calm antivirus for Windows. No ads, no popups, no scare tactics — just a friendly window that scans your files and stays out of your way.
- Signature scanning — files are hashed with SHA-256 and checked against a plain-text signature database you can update with one click.
- Heuristics — flags common malware tricks: double extensions
(
invoice.pdf.exe), high-entropy executables in temp folders, hidden system executables in the user profile. - Real-time protection — watches the folders you choose (Downloads and Desktop by default) and scans new files as they appear. Known threats are quarantined automatically; suspicious ones are only ever reported.
- Safe quarantine — flagged files are XOR-neutralized and stored, never silently deleted. Restore is one click and byte-for-byte identical.
- Quick / full / custom scans with exclusions, size limits and cancel.
- Zero dependencies — a single .NET Framework 4.8 exe that runs on any stock Windows 10/11 machine.
No SDK or Visual Studio needed — Harbor builds with the C# compiler that ships with Windows:
powershell -ExecutionPolicy Bypass -File build.ps1The exe lands in build\Harbor.exe. Run the engine tests with:
powershell -ExecutionPolicy Bypass -File tests\run-tests.ps1The installer is built with Inno Setup 6
(free). After running build.ps1:
iscc installer\Harbor.issThe setup exe lands in dist\. A portable zip of the build\ folder works
just as well — Harbor keeps all of its data in %AppData%\Harbor.
Don't download real malware to test an antivirus. Instead, create a text file containing exactly this line and scan its folder:
HARBOR-AV-TEST-FILE v1 - this file is harmless and exists only to test Harbor's detection.
Harbor flags it as Harbor-Test-File (not a virus). The standard
EICAR test file is
also in the signature database, but note that Windows Defender will usually
grab EICAR files the moment they are written.
signatures\signatures.txt — one entry per line, sha256|Threat name,
# for comments. Point Settings → Signature updates at the raw GitHub URL
of this file to pull updates.
- Harbor is a lightweight companion scanner and a learning project, not a replacement for Windows Defender. They run happily side by side.
- Harbor runs entirely in user mode. A kernel-mode minifilter driver (deeper, boot-time protection) is on the roadmap, but requires a signed driver package, so it will ship separately when it's ready.
- No telemetry. Nothing leaves your machine, ever.
MIT — see LICENSE.