SDSA: a second opinion for your Windows PC : Security, Malware removal, Windows, Tools

Your antivirus says everything is fine. Your friends say your account is sending them crypto scam links. Who is right?

That exact situation is why I built SDSA - Sophisticated Device Security Audit (Detect · Remove · Protect): a security checker for Windows 10 and 11 that looks at your PC the way a malware analyst would. Instead of only asking "does this file match a known virus?", it asks "what is this program actually doing?" - what starts with Windows, what sends data to the internet, what reads your saved passwords, what is changing your files, and what has been altered to hide itself. That is how it catches brand-new malware that no antivirus has a signature for yet.

In one sentence: SDSA audits your whole PC in a few minutes, gives it a security score out of 100, explains every problem in plain English, can keep watching your PC afterwards, has an optional AI assistant that learns from your decisions, and - only if you say yes - removes the threats in a way that can always be undone.

 

What's new in version 1.33.

• AI analyst - a second opinion on every finding. It works with no AI model installed (a small built-in engine that learns from your "Real threat" / "False alarm" clicks), and gets better reasoning if you run a local model with Ollama or choose to use Claude. It only advises: it can never change anything by itself.
• Developer and AI-agent supply-chain check - booby-trapped Python, npm and git settings, Python .pth hooks, VS Code tasks that run when you open a folder, and hostile AI-assistant settings (hooks, MCP servers, instruction files with hidden text).
• Policy lock - stops malware from switching off Task Manager, Registry Editor, Folder Options, Run and Command Prompt, and names the program that tried.
• Download inspector - looks at a file while it is still downloading: a program dressed up as a PDF, a double extension, a shortcut in disguise.
• Session guard - tells you which program reads your browser's cookie and saved-login files (what an info-stealer copies to sign in as you).
• Administrator helper - switch on the built-in Administrator account for an installer for a limited time, with a random password, and have it switched off again automatically.
• Startup control - switch programs on and off in the Startup tab, just like Task Manager's "Startup apps", and undo any time.

The real case that started it

A PC I worked on had Microsoft Defender switched on and fully up to date. Defender found nothing. Meanwhile the owner's social media account was messaging crypto scam links to all their friends, and their Netflix account had been taken over (profiles renamed, plan and language changed).

The cause was a download: a fake copy of a popular AI tool on GitHub, uploaded by a look-alike account. Four minutes after it ran, it had quietly copied itself into about twenty places on the PC under harmless-sounding names - fake "Malwarebytes", fake "Firefox service", fake "nginx", fake Windows update tasks hidden among Windows' own scheduled tasks - and it was stealing browser sessions and passwords.

SDSA caught it because of its behaviour: unsigned programs running from folders like C:\Users\Public, many copies of the same file under different names, hidden startup tasks, and constant connections to raw internet addresses. The cleanup quarantined 107 malicious files, removed every way it restarted itself, and blocked its command servers in the firewall. Antivirus signatures would have missed all of it for weeks.

Lesson: "no virus found" is not the same as "clean".

What SDSA checks

One click on Run full audit checks all of this and gives you a score from 0 to 100 (Good, Fair, Needs attention, At risk, or Compromise indicators found):

• File-infecting viruses and USB worms, first of all - Ramnit and Sality (viruses that infect your programs and spread through USB sticks and cracked software) and the USB worms Yuyun Cantix and Bondat. SDSA looks for what they leave behind: dropped files, startup tricks, folders replaced by look-alike shortcuts on your drives, programs whose internal layout matches a file infector, and what Windows Defender itself recorded about them earlier. A new shared Windows-program reader also spots packed or disguised programs from their headers alone, without running them.
• Running programs - digital signatures, programs pretending to be Windows files (a fake svchost.exe outside the Windows folder), programs running from places malware likes to hide, and dangerous script command lines (encoded PowerShell and similar).
• Code hidden inside programs - malware often injects itself into a trusted program such as your browser. SDSA looks inside running programs for code that does not belong to any file, and for threads started from the wrong place.
• Who is sending your data out - every program that talks to the internet, which servers it contacts, programs that "check in" with a server on a steady clock (a classic remote-control trojan habit), connections to servers on your own block list (for example from a past infection), and tunnels or mining pools used by unsigned programs. The Connections tab shows every live connection, incoming and outgoing, with the program behind it.
• Everything that starts with Windows - Run keys, the Startup folder, scheduled tasks (including fake ones hidden in Microsoft's folders), services, Winlogon hijacks, AppInit DLLs and WMI subscriptions. The Startup tab can also switch entries off and on for you.
• Developer and AI-assistant supply chain - Python .pth files and start-up hooks, pip and npm pointed at another package source, npm install scripts that download or run hidden commands, git hooks and URL rewrites, VS Code or Cursor tasks that run the moment you open a folder, AI-assistant hooks, changed API addresses and MCP servers started from risky places, and instruction files for AI assistants (such as CLAUDE.md or .cursorrules) that contain invisible text or "ignore your previous instructions" tricks. SDSA also scans your project and download folders for these before you open them.
• Keyloggers and spy tools - known spying programs, programs that contain keyboard-capturing code plus a way to send data out, and hidden files that look like keystroke logs.
• Your browsers - every extension rated by what it is allowed to do (read all sites, cookies, history, intercept traffic), browser policies forced by adware, hijacked shortcuts and proxy settings.
• Account-theft malware - Discord token-stealer code, leftover "stealer logs", password-stealing scripts, and crypto wallets that are at risk. These are what usually make an account start spamming your friends.
• Phishing - paste a link or pick a file and SDSA tells you how suspicious it looks without opening it, and it warns when something changes your hosts file, DNS or proxy to send you to fake sites.
• Tampered Windows files - SDSA checks the digital signature of about 7,000 Windows system files in under a minute. A genuine Windows file is always signed, so an infected or replaced one stands out.
• DLL side-loading - an attacker makes a trusted, signed program load their hidden DLL so the malware runs under a trusted name. SDSA checks the DLLs of running programs and the folders where such bundles are dropped.
• Installed apps and downloads - adware, remote-access tools you may not know about, and recently downloaded programs, including the website each one came from.
• Windows security settings - Defender and its exclusions, firewall, Windows Update, UAC, SmartScreen, remote access, proxy, DNS servers, the hosts file, suspicious root certificates, and user accounts - including a warning if the built-in Administrator account has been switched on without you knowing.
• Rootkit check - SDSA compares several independent views of Windows (different ways of listing programs, connections and services). Anything visible in one view but hidden in another is a rootkit sign.
• Tricks that block security tools - malware often stops you from opening Task Manager, Registry Editor, Folder Options, the Run box, Command Prompt or your antivirus, or switches Defender off through a hidden policy. SDSA looks for all of these and can repair them.
• Disk space - if your drive is nearly full, SDSA shows what is filling it and which programs are writing to it right now.

Every problem comes with what it means, the evidence, and what to do about it. For any suspicious file you can look it up on VirusTotal with one click - only the file's fingerprint (hash) is sent, never the file.

A built-in library of how attacks work

The Threat library tab explains, in plain language, 35 ways malware gets into a Windows PC and what it does next - fake installers and cracks, the "verify you are human" paste trick, USB worms, stolen logins, ransomware and more. Each entry tells you the signs that you are being attacked, how to defend, and - honestly - whether SDSA checks for it or not. It can also download the public list of security holes that attackers are already using right now (from the US government's CISA), so you know which updates to install first.

The AI analyst - a second opinion that learns from you

An audit can list dozens of findings. The AI analyst tab helps you decide which ones matter: it ranks them, says why, and suggests a next step. It has three engines, tried in this order:

1. Ollama (a model running on your own PC) - if you use Ollama, SDSA can ask your local model. Nothing leaves your PC.
2. Claude (optional, off by default) - only if you switch it on and save your own API key. The findings are redacted first (your user name, PC name, e-mail addresses, LAN addresses and tokens are removed), you can preview exactly what would be sent, and the key is stored encrypted for your Windows account.
3. The built-in engine - always available, works offline, needs no model and no extra software. It looks at features of each finding (how serious it is, where the file lives, whether it is signed, whether its name looks machine-made, whether Defender or SDSA confirmed it) and gives a probability and the reasons. It learns from you: every time you press Real threat or False alarm it adapts to the programs on your PC. It is not a language model and does not pretend to be one.

The AI never acts on its own. The most it can do is look things up with a few read-only tools (inspect a file, see which startup entries mention it, list the files beside it, check a fingerprint against your Threat memory, analyse a link) and then propose something. A proposal is only a button that opens SDSA's normal confirmation window, with its usual undo. Nothing is deleted, blocked or changed until you confirm there.

A few safety rules are built in: text inside findings (file names, command lines) can be written by malware, so it is handed to the model as untrusted data with an instruction never to follow it; the answer must be strict structured data or it is thrown away; what the built-in engine learns can only nudge a score, never overrule the evidence; and a Critical finding is never rated "benign". One honest warning from my own tests: small local models can over-claim - mine once called a perfectly legitimate cloud-sync app "likely malicious". That is why SDSA shows the built-in engine and the model side by side and flags when they disagree. Treat the AI as a second opinion, never as the verdict.

What SDSA can do about it

Emergency Quarantine (with Undo)

If the audit finds real threats, Emergency quarantine shows you exactly what it will do, and does nothing until you confirm. Then it:

• stops the malicious programs,
• removes everything that restarts them (startup entries, scheduled tasks, services),
• moves the files into a quarantine folder - nothing is deleted,
• hunts the whole PC for hidden copies of the same malware by their fingerprint,
• blocks the malware's servers in Windows Firewall.

Every single step is recorded and can be restored from the Quarantine tab if something turns out to be a false alarm.

Some malware files are locked while they run, so they cannot simply be moved. Like the old manual trick of renaming the file and deleting it after a reboot, SDSA keeps a copy, renames the file so it can no longer start, and has Windows remove it early during the next restart. If you would rather work with the malware switched off, SDSA can restart your PC to the Safe Mode menu with a 30-second countdown you can cancel.

Block a connection, trust a program, leave a folder alone

• Block a suspicious internet address, or a whole program, in Windows Firewall with one click - and undo it later. SDSA refuses to block your own router or Windows itself.
• Trust a program you know is yours (identified by its file fingerprint, so a replaced file is no longer trusted).
• Exclude a file or folder you do not want scanned, such as a folder of malware samples you study. Whole drives, the Windows folder and the places malware loves are not allowed, and serious findings are never hidden.

Control what starts with Windows

The Startup tab lists every program that starts with your PC and lets you switch each one off or on with one click - the same switch as Task Manager's "Startup apps". Nothing is deleted, so every change can be undone with the same button.

System Check & Repair - when malware fights back

Some malware breaks Windows on purpose so you cannot remove it: it hijacks programs so they will not open, disables security services, deletes Safe Mode, switches off Task Manager, Registry Editor, Folder Options or the Run box, or breaks how .exe files start. SDSA's system check finds these tricks and repairs them - again with a backup of everything it changes.

If malware has blocked even SDSA itself, there is SDSA-Repair.bat, which needs nothing but Windows' own Command Prompt. It lists what it found, changes nothing until you type YES, and saves a backup of every setting first.

Bloatware cleanup

SDSA recognises around 120 preinstalled extras, sponsored apps, PC-maker junk, antivirus trials, scam "PC cleaners" and apps that sell your internet bandwidth - each rated Safe to remove, Optional or Keep, with the reason. The list is updated weekly from a community-maintained catalogue, and parts of Windows can never be selected by mistake.

Staying protected after the cleanup

These are switched on by you, one by one, in the Watch tab. Your choices are remembered.

• Watch mode - SDSA remembers what your clean PC looks like and alerts you with a Windows pop-up the moment something new starts itself, starts sending data out, or begins checking in with a server on a timer. It judges programs by their behaviour, so it also catches malware nobody has seen before.
• Script Guard - when a script (PowerShell, a .bat, a .vbs...) starts from a place malware likes, such as Downloads or Temp, SDSA pauses it for a moment, has Windows Defender and its own checks look at it, and lets it run if it is clean. Scripts of a genuine, signed installer are let through while it installs, and your AI coding assistants (such as Claude Code and Codex) are recognised and left alone.
• Fake-CAPTCHA detector - a website says "verify you are human" and tells you to press Win+R and paste a command it copied for you. That command is the malware. SDSA warns you the moment such a command lands in your clipboard or the Run box - before you run it.
• Backup-deletion alarm - ransomware deletes your Windows restore points and backups first, so you cannot roll back. SDSA stops those deleting commands, pauses the program that launched them, and warns you if your restore points suddenly vanish.
• Ransomware brake - SDSA watches your document folders for the signature of ransomware: dozens of files rewritten or renamed in seconds. It finds the program doing it and pauses it (it never kills it) so you decide: Resume if it was you, or Stop it. It acts within a second or two, so a few files can still be lost - keep a backup.
• Download inspector - a browser writes a download into a temporary file (.crdownload in Chrome and Edge, .part in Firefox) and the first bytes arrive long before it finishes. SDSA reads that start and warns you before you can open the file: a program disguised as a PDF or picture, a double extension like invoice.pdf.exe, a shortcut dressed up as a document, an archive named like a photo, or a program with the layout of a file infector. It can only see what has arrived so far, so it cannot check the signature until the download completes.
• Policy lock - worms such as Yuyun Cantix switch off Task Manager, Registry Editor, Folder Options, Run and Command Prompt so you cannot remove them, and Windows has no switch to stop that. SDSA adds one: a single permission on the three registry keys that hold those settings, so a program running as you gets "Access denied" when it tries. A second guard re-checks every second and puts back anything that slips through. When SDSA runs as administrator it also records which program was refused ("Blocked: wscript.exe tried to switch off Task Manager"). A Test the lock button proves it works without touching any real setting. Honest limit: it is a permission, not a kernel filter, so malware running as SYSTEM can still get around it - SDSA then undoes the change within about a second and tells you.
• Session guard - info-stealers rarely crack your passwords; they copy your browser's cookie and saved-login files and sign in as you, even past two-factor codes. Only the browser has a reason to open those files, so SDSA asks Windows to record which program reads them and names anything else. It needs administrator rights, adds only an audit entry (your files are not changed) and is removed when you switch it off.
• Administrator helper - some installers ask for an administrator password. Switching the built-in Administrator account on by hand and forgetting to switch it off leaves a favourite way in for malware. SDSA switches it on for 10-60 minutes with a strong random password shown once and never saved, then Windows itself switches it off again (even if SDSA is closed or the PC restarts) and replaces the password. It also notices when Windows opens the administrator prompt and lists the programs that just started, so you can tell whether it is the installer you ran. And the audit warns you if that account is ever on without SDSA having switched it on.
• Tripwires - hidden decoy "passwords", "seed phrase" and "2FA codes" files full of fake data, placed where info-stealers look. Nothing legitimate ever opens them, so if anything does, SDSA names the thief.
• Dead-man switch - if malware kills SDSA while it is watching, a small Windows task notices and raises the alarm.
• Self-protection - SDSA fingerprints its own files, shields its own process from being closed by ordinary programs, and can lock its settings folder so that only an administrator can change it.
• Start with Windows - one switch makes SDSA start in the tray at every logon (Windows asks for permission each time, so you stay in control), and your protections switch themselves back on.
• History log - every scan, finding, alert and fix is saved with its date and time, and can be exported as a text file, a CSV spreadsheet or a PDF report. Handy for keeping records, or for sending to whoever is helping you.

Scan an infected PC from a USB stick

When a PC is badly infected, you should not have to install anything on it. SDSA is a single file (SDSA.exe) that you can put on a USB stick and run on any Windows 10/11 PC with no installation. Reports are saved on the stick, out of the malware's reach, and SDSA checks that its own file has not been tampered with. If your stick has a write-protect switch, turn it on - then nothing on the infected PC can change SDSA.

Handy extra: on a PC that has Windows Defender, SDSA can read Defender's record of what it has caught and keep the fingerprints of the flagged files that are still on disk, on your stick (the Threat memory). Plug the stick into a PC without Defender, and SDSA can still recognise the very same files there - nothing is uploaded, only fingerprints are compared.

Who it helps

• Anyone whose account was hacked - Facebook, Instagram, Discord, Netflix or email suddenly doing things you did not do. SDSA finds the info-stealer that took your sessions, and the Account safety tab walks you through recovering each account safely.
• Anyone who downloaded something they now regret - a cracked game, a "free" tool, a phone-flashing or unlocking tool, an AI app from an unofficial page, or an email attachment.
• Developers and people who use AI coding assistants - a cloned repository, an npm or pip package, or a shared AI-assistant setting can run code on your PC. SDSA now looks in exactly those places.
• Families and the "computer person" everyone calls - check a relative's PC from a USB stick in a few minutes and get a clear report.
• Small offices and technicians - a repeatable audit with a score, a history and exportable reports.
• Anyone with a slow, pop-up-filled PC - adware, bad extensions and bloatware are usually the reason.

How to use it

1. Unzip the download (onto a USB stick, or any folder) and double-click SDSA.exe. Click Yes on the Windows permission prompt - administrator rights let it see everything. A shield icon appears next to the clock and the dashboard opens in your browser.
2. Click Run full audit. It takes a few minutes, including a short watch of your network traffic.
3. Read the Overview: your score and the problems sorted from most to least serious, each with what to do. Open the AI analyst tab if you want a ranked second opinion.
4. If there are Critical or High threats, disconnect from the internet, click Emergency quarantine, review the list and confirm.
5. Run the audit again to confirm the PC is clean, then open the Watch tab and switch on the protections you want.
6. If accounts were affected, change your passwords from another, clean device, and follow the Account safety checklist.

The dashboard only opens from your own PC and needs a single-use link, so to open it again later, right-click the shield icon and choose Open dashboard.

A note about the Windows warning: SDSA.exe is not digitally signed yet, so on some PCs Windows SmartScreen says "Windows protected your PC" the first time. If you downloaded it from this page, click More info and then Run anyway. To be sure you have the real file, compare its fingerprint with the one at the bottom of this page. If a scanner on VirusTotal flags it, see the question about VirusTotal further down.

Safe by design

• Checking never changes anything. The audit only reads.
• You stay in control. Quarantine, repairs, blocking and app removal only happen after you confirm, and can be undone. The guards pause things instead of destroying them. The AI analyst can only propose.
• Private. The dashboard is reachable only from your own PC, and only through a link that works once. Nothing about your PC is uploaded. The only online look-ups are the ones you click or switch on yourself: a file fingerprint to VirusTotal or a public list of known-good software, the public list of exploited security holes, the public bloatware list, and - only if you turn it on and save your own key - redacted findings to Claude.
• Transparent. SDSA always runs under its real name - it never hides from you or from Task Manager.
• Tested the hard way. I attacked SDSA myself, the way malware on the same PC would, and fixed everything I found: other programs could have taken over the dashboard and a normal program could have shut SDSA down. Both are closed now. A program that already has administrator rights can still stop any program - that is why the dead-man switch exists.

What SDSA is not

SDSA is not a replacement for your antivirus - keep Microsoft Defender (or your antivirus) switched on. SDSA is the second opinion that looks at behaviour instead of signatures. And no program running inside Windows can fully trust Windows once a deep (kernel-level) rootkit is installed; if SDSA reports signs of one, run the Microsoft Defender Offline scan (Windows Security > Virus & threat protection > Scan options), which checks the PC before Windows starts.

Some honest limits: no tool can promise to stop every future attack; the ransomware brake reacts after a second or two, so back up your important files; viruses such as Sality change their own code, so SDSA can confirm an infected program but can never promise a program is clean; the Policy lock and the Session guard are Windows permissions and audit records, not a kernel driver, so something running with the highest rights can still get around them (SDSA tells you when it happens); the AI analyst, especially a small local model, can be wrong - it is a second opinion, not a verdict; and any security tool - including SDSA and Defender - can raise a false alarm, so SDSA shows its reasoning and lets you undo.

Quick questions

Does it need the internet?
No. The audit and the quarantine work offline - which is exactly how you should run them on an infected PC. The AI analyst's built-in engine is offline too. A few optional features go online, but only when you click or switch them on.

Do I need an AI model or an API key?
No. The built-in engine needs neither. Ollama and Claude are optional extras, and Claude is off until you switch it on and save your own key.

Will it delete my files?
No. Quarantined files are moved, not deleted, and can be restored with one click.

Do I need to install anything?
No. SDSA.exe is one file; there is nothing to install and you do not need Python.

What do I need?
Windows 10 or 11. Run it as administrator (it asks) for the full picture.

I uploaded SDSA to VirusTotal and a few scanners flagged it. Is it malware?
No - but here is exactly what I saw, so you can judge for yourself. When I scanned this version (1.33.0, the fingerprint above) on VirusTotal in October 2026, 4 of 70 engines flagged it: Microsoft (Trojan:Win32/Wacatac.B!ml), Bkav Pro, SecureAge and Zillya. The rest found nothing, including Avast, AVG, Avira, BitDefender, ClamAV and Acronis. All four labels are generic: none names a real virus family, and the !ml at the end of Microsoft's label means a machine-learning guess, not a recognised virus. On my own PC, Microsoft Defender (fully up to date, cloud protection on) scanned this exact file and found no threats.
Why does it happen? To catch info-stealers, ransomware and fake-CAPTCHA attacks, a security checker has to know how they work: which browser files a stealer copies, which commands ransomware uses to delete your backups, what a "paste this into Win+R" trick looks like. SDSA contains all of that knowledge so it can look for it - it only looks; it never copies your cookies or passwords, and nothing is uploaded. A machine-learning scanner reads the same words and patterns in the program and cannot tell a detector from the thing it detects. That is why security tools - including well-known ones - so often get false alarms. SDSA also is not digitally signed yet and is a Python program packed into a single .exe, both of which make scanners more suspicious. The usual cures are a false-positive report to each vendor and a digital signature on the program.
You do not have to take my word for it: compare the fingerprint above, scan the file with Microsoft Defender, read what each feature does on this page, or try SDSA first on a PC you can afford to be wrong about. If your antivirus blocks the file, the decision is yours: if you are unsure, do not run it on your main PC, and ask in the Facebook group instead. If you see a detection that is not listed here, please tell me there so I can look into it.

Get SDSA: Download SDSA from MEGA
Check the download: the SHA-256 fingerprint of SDSA.exe (version 1.33.0) is
1C04C3B9DBB08283BFD1A98DCE9D006ED7DD7EA8175977A7B23DDF813D58597E
(in a Command Prompt: certutil -hashfile SDSA.exe SHA256 - the two should match exactly. If you download a .zip instead, hash the SDSA.exe inside it.)
Need help reading your report? Post it (with personal details removed) in our Facebook group or message our Facebook page.

SDSA version 1.33.0 for Windows 10/11 - updated October 2026. Also on MLEA Digital Systems.