Thank you very much for taking the time to take a look and provide feedback. It is really valuable.

In answer to your question, my software is capable of detecting unknown and polymorphic malware. Antivirus uses signatures (basically the malware equivalent of a fingerprint). So unless AV has seen the malware before elsewhere, it will go undetected. This leaves you vulnerable until AV vendors receive a sample of the specific variant you have, analyze it, and release new definitions (assuming the malware does not disable your updates or your AV entirely). And if the malware is polymorphic (varying slightly on every computer it is installed on), AV may never have signatures capable of removing any variant of the malware you receive.

In addition, my software also detects file-less malware which AV often struggles with. It can also detect legitimate software that is being used for malicious purposes (some malware relies on Windows binaries to do its harm). And I also have the ability to remove rootkits present on a system with my software. Additionally, my software can remove the Potentially Unwanted Programs (known as PUPs) that AV typically does not. As in all cases, this will only be done without explicit permission from the user once I detect the malicious software.

It is important to note that my software is designed to detect only persistent malware (malware capable of automatically launching when you restart your computer). There is a small subset of malware that does not make an attempt to persist. By design, the technology is not designed to handle those threats. It is a tradeoff that allows me to make the software less resource-intensive and easier to manage with a small team (just me volunteering my time for the incident response at the moment). But I think it is important to be honest about what a security product will and won't do - there is a lot of snake-oil in the industry unfortunately. It is also important to note that because my software does not run in a real-time protection mode (for liability rather than technical reasons), it will not stop ransomware. I am working on a separate solution to that problem.

I hope that gives you a better idea of what types of threats I am capable of detecting and remediating. If you have any other questions (or want me to go into more technical detail), feel free to follow-up :). Thanks again for the feedback.

Thanks for taking the time to take a look. Let me know if you have any questions.

That's completely reasonable (and pretty much the answer I give on one of my FAQ question). I am partnering with one university this month and hopefully another by the end of the month. When they are willing to publicly vouch for the security offering, would you like me to let you know?

Thank you for taking a look, downloading, and the great feedback.

If you have any questions or feedback (now or down the line), feel free to reach out to me here, via LinkedIn (found on the website in the About Me section), or at joe@SolidusSecurity.com.

The length of the install comes entirely from the hashing of files in the areas that are monitored on the system. The initial hashing routine is pretty primitive, hashing the same file multiple times if it is triggered by multiple areas of the registry. The next version will cache the previous results once a file is hashed to speed that up. Hopefully that will make enough of a difference to avoid a user thinking the install might have hung. But if not, your suggestions are good. I cannot provide an accurate time estimate indicator (at least without doing more work than would make sense), but it is a good idea to give some indication that the install is progressing. I should be able to do that.

Thank you again.