BVAntivirus

What is it for?

BVAntivirus helps you verify a Mac after a security scare and remove leftovers only after you explicitly allow it:

• After phishing / fake sites — check disk, browser and running processes for leftovers
• Browser hygiene — extensions and invasive permissions often used by adware / hijackers
• Persistence checks — LaunchAgents/Daemons, login items, suspicious shell/cron patterns
• Signature matching — ClamAV + public feeds (URLhaus, MalwareBazaar, OpenPhish)
• Safe cleanup — interactive confirmation before quarantine; nothing is deleted silently
• Field use — USB kit with a separate updatable signature database pack

Designed for a USB stick

The portable kit is two pieces you carry together:

What you see when you run it (screenshots)

These are example terminal screens from a real BVAntivirus session (portable / USB style). Answers are always interactive: type y or n.

1) USB launcher menu

After double-clicking AVVIA_BVAntivirus.command, Terminal opens with a simple menu. Choose 2 for a full scan.

Example: portable menu on the USB stick.

2) Permission before scanning

Nothing starts until you confirm. The tool explains scopes (filesystem, browser, memory) and that the first phase is read-only.

Example: permission panel before the scan starts.

3) Scan in progress

You will see browsers, LaunchAgents, hash matching, ClamAV batches on high-risk paths, then memory/process checks. ClamAV does not try to scan the entire disk (that would time out for little gain).

Example: full scan progress output.

4) Clean result

If nothing matches current signatures, you get a clear “No threats detected” message and a JSON report path.

Example: clean system against current signatures.

5) Finding + quarantine confirmation

If something is flagged (for example an extension with many invasive permissions), a table is shown. Quarantine happens only if you answer y item by item.

Example: findings table and quarantine permission prompt.

Step-by-step: use from a USB stick

1. Download BVAntivirus.zip and unzip it.
2. Copy the folder BVAntivirus to a USB stick (optional but recommended).
3. On the target Mac, open the folder and double-click AVVIA_BVAntivirus.command.
4. If macOS blocks it: right-click → Open → Open (Gatekeeper).
5. First run needs Python 3 on that Mac; dependencies install into app/vendor inside the package.
6. Optional but recommended on the host: brew install clamav so ClamAV engines are available.
7. From the menu: choose 1 to refresh signatures (internet), then 2 for full scan.
8. Answer y/n to each permission prompt. Review findings before quarantine.
9. Reports and quarantine live under data/ inside the package (portable mode).

Step-by-step: local install on one Mac

1. brew install python clamav (ClamAV recommended).
2. cd BVAntivirus && ./bin/install.sh
3. ./bin/bvantivirus update — downloads threat feeds + ClamAV DB into ~/Library/Application Support/BVAntivirus/
4. ./bin/bvantivirus scan --full — filesystem + browser + memory
5. Other useful commands:
   • ./bin/bvantivirus scan --browser
   • ./bin/bvantivirus scan --memory --deep
   • ./bin/bvantivirus status
   • sudo ./bin/bvantivirus scan --full (more network visibility)

cd BVAntivirus
./bin/install.sh
./bin/bvantivirus update
./bin/bvantivirus scan --full

What it scans (details)

Finding categories

• clamav / hash_match — signature or known malware hash
• bad_extension / suspicious — extension list or permission heuristics (verify manually)
• adware / persistence — known adware names or LaunchAgent patterns
• memory — suspicious process or network behavior

Build / refresh the USB kit

./bin/bvantivirus update
./bin/build-portable.sh
# copy dist/BVAntivirus-Portable → USB
# double-click AVVIA_BVAntivirus.command

# later: refresh only signatures
./bin/pack-database.sh
# replace USB database/ with dist/BVAntivirus-Database contents

Typical kit size with ClamAV signatures: roughly 100–200 MB.

Quarantine and restore

• Local install quarantine: ~/Library/Application Support/BVAntivirus/quarantine/
• USB portable quarantine: BVAntivirus-Portable/data/quarantine/
• Each item has a .bva.json sidecar with original path and reason.
• To restore: move the folder/file back to original_path, or reinstall from the official vendor.

Project facts

Related

Related reading: AI-Powered Malware: A New Era of Cyber Threats.