Hash-only, always
Every check sends a SHA-256 digest, never file content. Nothing you scan is uploaded anywhere, by any source, ever.
SHA-256 only · nothing else leaves your machine
Hash it once.
Check it against four databases.
C++AntiVirus walks a folder, computes a SHA-256 for every file, and looks each hash up against VirusTotal, MetaDefender, MalwareBazaar and Hybrid Analysis in parallel — then lets you clear out whatever comes back flagged, right from the results table.
Free · open build script · no telemetry
01What it actually does
Four sources, one verdict
Results from VirusTotal, MetaDefender, MalwareBazaar and Hybrid Analysis are merged into a single combined report per file, engines tagged by source.
Files and sources in parallel
Several files are hashed and queried at once, and every source for a given file is queried concurrently — each source still obeys its own rate limit.
Delete straight from results
Flagged files get a Delete button, or clear every detection in one pass with Delete All Detected. Both ask for confirmation first.
Bring your own keys
Every source is optional. Add a free key for any of the four and it switches on — skip one and it's silently left out, nothing blocks.
Sources you can verify
Every hit links back to the source's own permalink, plus the full per-engine breakdown — nothing here asks you to just trust a verdict.
02Four independent databases
Each one is a separate opt-in client behind the same interface — add a key, it joins the scan.
malicious
VirusTotal
~70 AV engines behind a single hash lookup. The broadest static-detection coverage of the four.
suspicious
MetaDefender
OPSWAT's cloud multi-scanner, 30+ additional engines that don't always overlap with VirusTotal's set.
confirmed
MalwareBazaar
abuse.ch's confirmed-malware corpus. A hit here is always a detection — a miss just means "not cataloged."
sandboxed
Hybrid Analysis
Falcon Sandbox detonation verdicts across several environments — catches behavior the static engines miss.
03Download
C++AntiVirusSetup.exe
SHA-256
1113bb3976134a9a730d9b3e898e6646ba18f0ee0d2da4a5081b767c512e6586
Yes, really — verify it yourself the same way the app verifies everything else.
What the installer does
- Bootstraps a managed MSYS2 toolchain if you don't already have one
- Fetches ImGui, nlohmann/json, tinyfiledialogs and a prebuilt libcurl
- Compiles the app from source, on your machine, and drops it on your Desktop
It's unsigned, so Windows SmartScreen will warn you the first time — that's expected for a small independent build, not a sign of a compromised download. Choose More info → Run anyway if you're comfortable proceeding, or read the source yourself first.