BVAntivirus

What is it for?

BVAntivirus helps you verify a Mac after a security scare and remove leftovers only after you explicitly allow it:

• After phishing / fake sites — check disk, browser, running processes and DNS/network integrity for leftovers
• Browser hygiene — extensions and invasive permissions often used by adware / hijackers
• Persistence checks — LaunchAgents/Daemons, login items, suspicious shell/cron patterns
• DNS / network integrity — system resolvers, /etc/hosts, proxies, canary DNS vs trusted resolvers, TLS checks (hijack / MITM hints)
• Mail / certificates / profiles — forwarding rules, custom trust CAs, VPN and MDM/mobileconfig leftovers
• Free disk space — Trash, temps, caches, cookies and similar; you confirm each category before anything is deleted
• Filesystem repair — broken symlinks, orphan LaunchAgents, empty folders, stale partials (not Disk Utility First Aid); confirm each category
• Signature matching — ClamAV + public feeds (URLhaus, MalwareBazaar, OpenPhish)
• Safe actions — interactive confirmation before quarantine, cleanup or repair; nothing is deleted silently
• Field use — USB kit with a separate updatable signature database pack

Designed for a USB stick

The portable kit is two pieces you carry together:

What you see when you run it (screenshots)

These are example terminal screens from a real BVAntivirus session (portable / USB style). Answers are always interactive: type y or n.

1) USB launcher menu

After double-clicking AVVIA_BVAntivirus.command, Terminal opens with a simple menu (v1.3.0). Choose 2 for a full scan; options include network/DNS, posture, disk cleanup, filesystem repair, and donate.

Example: portable menu on the USB stick.

2) Permission before scanning

Nothing starts until you confirm. The tool explains scopes (filesystem, browser, memory, network/DNS, posture) and that the first phase is read-only.

Example: permission panel before the scan starts.

3) Scan in progress

You will see browsers, LaunchAgents, hash matching, ClamAV batches on high-risk paths, then memory/process, network/DNS and posture checks. ClamAV does not try to scan the entire disk (that would time out for little gain).

Example: full scan progress output.

4) Clean result

If nothing matches current signatures, you get a clear “No threats detected” message and a JSON report path.

Example: clean system against current signatures.

5) Finding + quarantine confirmation

If something is flagged (for example an extension with many invasive permissions), a table is shown. Quarantine happens only if you answer y item by item.

Example: findings table and quarantine permission prompt.

Step-by-step: use from a USB stick

1. Download BVAntivirus.zip and unzip it.
2. Copy the folder BVAntivirus to a USB stick (optional but recommended).
3. On the target Mac, open the folder and double-click AVVIA_BVAntivirus.command.
4. If macOS blocks it: right-click → Open → Open (Gatekeeper).
5. First run needs Python 3 on that Mac; dependencies install into app/vendor inside the package.
6. Optional but recommended on the host: brew install clamav so ClamAV engines are available.
7. From the menu: choose 1 to refresh signatures (internet), then 2 for full scan (includes network/DNS + posture). Option 5 = network/DNS · 6 = Mail/certs/VPN posture · 8 = disk cleanup · 9 = filesystem repair (confirm each category).
8. Answer y/n to each permission prompt. Review findings before quarantine.
9. Reports and quarantine live under data/ inside the package (portable mode).

Step-by-step: local install on one Mac

1. brew install python clamav (ClamAV recommended).
2. cd BVAntivirus && ./bin/install.sh
3. ./bin/bvantivirus update — downloads threat feeds + ClamAV DB into ~/Library/Application Support/BVAntivirus/
4. ./bin/bvantivirus scan --full — filesystem + browser + memory + network/DNS + posture
5. Other useful commands:
   • ./bin/bvantivirus scan --browser
   • ./bin/bvantivirus scan --memory --deep
   • ./bin/bvantivirus scan --network — DNS / hosts / proxy / TLS canaries
   • ./bin/bvantivirus scan --posture — Mail + certificates + VPN/MDM
   • ./bin/bvantivirus cleanup --dry-run — measure reclaimable space
   • ./bin/bvantivirus cleanup — free disk space (confirm each category)
   • ./bin/bvantivirus repair --dry-run — list broken links / orphans
   • ./bin/bvantivirus repair — filesystem repair (confirm each category)
   • ./bin/bvantivirus status
   • sudo ./bin/bvantivirus scan --full (more process/network visibility)

cd BVAntivirus
./bin/install.sh
./bin/bvantivirus update
./bin/bvantivirus scan --full

What it scans (details)

Finding categories

• clamav / hash_match — signature or known malware hash
• bad_extension / suspicious — extension list or permission heuristics (verify manually)
• adware / persistence — known adware names or LaunchAgent patterns
• memory — suspicious process or network behavior
• dns / network — suspicious resolver, hosts override, proxy, or TLS anomaly
• mail / certificate / profile — Mail rules, custom trust CAs, VPN/MDM/mobileconfig

Build / refresh the USB kit

./bin/bvantivirus update
./bin/build-portable.sh
# copy dist/BVAntivirus-Portable → USB
# double-click AVVIA_BVAntivirus.command

# later: refresh only signatures
./bin/pack-database.sh
# replace USB database/ with dist/BVAntivirus-Database contents

Typical kit size with ClamAV signatures: roughly 100–200 MB.

Quarantine and restore

• Local install quarantine: ~/Library/Application Support/BVAntivirus/quarantine/
• USB portable quarantine: BVAntivirus-Portable/data/quarantine/
• Each item has a .bva.json sidecar with original path and reason.
• To restore: move the folder/file back to original_path, or reinstall from the official vendor.

Project facts

Related

Related reading: AI-Powered Malware: A New Era of Cyber Threats.