Home › Agamemnon
Agamemnon3.1
A free, open-source antivirus for macOS and Windows. It sees every program the moment it starts, checks every file as it's saved against tens of millions of known threats, and stops today's stealers, ransomware and miners in the act, all on your own device.
Available now
macOS 13+
Windows 10 & 11
GPL-2.0
English · Türkçe
Agamemnon 3.1 for Mac
Now it watches everything, as it happens.
The biggest update yet. Agamemnon now protects your Mac the way commercial antivirus does, and it's still free, open source and private.
- Real-time file monitoring A protection helper uses Apple's Endpoint Security to see every new program the instant it starts, and checks every program, script, installer and archive as it's saved anywhere on your Mac.
- Stealers stopped at the door Programs that open your saved passwords, browser cookies, crypto wallets, notes or SSH keys are stopped within about a second, even when they hide behind built-in tools like cp or osascript.
- Self-protection If malware kills Agamemnon, it's back within seconds. Settings changed behind its back are put back, and a tampered app or malware list is reported. The helper installs without a password and updates itself.
- USB and BadUSB defence Drives are checked the moment you plug them in and ejected if they carry malware. Apps disguised as documents are flagged, and sticks that pretend to be a keyboard and type commands are caught.
- Apple's XProtect engine Apple's own malware rules, about 580 of them, now run on every file a scan finds, inside archives and on USB drives too, not only when a file is opened.
- Paste-command guard Fake “verify you're human” and “fix this error” pages trick people into pasting a malware installer into Terminal. Agamemnon warns you the moment you copy one.
- Sees through disguises Hidden scripts are decoded (base64, hex, split-up text) before they're checked, and unsigned programs are judged by what they're built to do, so brand-new stealers are caught too.
- Camera, microphone and Wi-Fi Know whenever your camera or microphone switches on and which app was in front, and get warned about open or weakly protected Wi-Fi networks.
- Updates, kept honest Finds outdated apps, Homebrew packages and macOS updates, and keeps Agamemnon itself up to date, checking every update's signature before installing it.
- ~1 sto stop a program stealing your passwords
- ~2 sto quarantine malware after it's saved
- 7detection engines working together
- 0false alarms across 50,000 programs and scripts
Real-time protection.
Agamemnon runs quietly in the menu bar on Mac and in the notification area on Windows. These shields work all the time, without you starting a scan.
- Behaviour protection Watches every new program and stops stealers, backdoors and miners as they run: fake password prompts, keychain, crypto-wallet and browser-data theft, secret screenshots and switching off macOS's download check.
- Ransomware shield Watches Documents, Desktop and Pictures, plus any folders you add. If files suddenly start getting scrambled, the unsigned program doing it is stopped and moved to quarantine.
- Download protection Every new download is checked the moment it finishes, including inside archives and disk images, and against where it came from. Dangerous files go straight to quarantine.
- Browser protection Finds adware extensions, search-engine hijacks and profiles that take over Safari, Chrome, Brave, Edge, Firefox, Arc, Opera or Vivaldi, with one-click removal.
- Startup and admin alerts Warns you when something sets itself up to start automatically or gets administrator rights, says who signed it and whether it is known malware.
- Encrypted DNS DNS-over-HTTPS or TLS for the whole computer with Cloudflare, Quad9, Mullvad, AdGuard and more, with malware-blocking options. On Windows it fails closed, so lookups never leak.
- 47M+known threats checked on macOS
- 50M+known threats checked on Windows
- ~1 sto react to a new program
- 0false alarms across 1.5 million files on an everyday Mac
Scanning and quarantine.
When you want to check something yourself, or let Agamemnon check on a schedule.
- Quick, full, custom and scheduled Drag files onto the window or the Dock icon, right-click in Finder or File Explorer and choose Scan with Agamemnon, or start a scan from the menu. A quick scan can run by itself every week or every day.
- No hiding in archives Looks inside ZIP, RAR, 7Z, TAR, ISO, DMG, PKG, MSI, CAB and more, up to 3 levels deep. Zip bombs are refused before anything is unpacked, and disguised names like invoice.pdf.exe are flagged.
- Quarantine vault Threats are moved, never deleted behind your back. Restore them or delete them for good: it's your call. On Windows the vault is encrypted with AES-256-GCM.
How detection works.
A file only has to fail one check. Known-malware lists catch what has been reported; rules and behaviour checks catch new builds that nobody has listed yet.
| Engine | What it checks | Platform |
|---|---|---|
| MalwareBazaar | SHA-256 of every file against more than 1.1 million confirmed malware samples from abuse.ch, plus a list of fresh samples refreshed every hour. No account needed. | macOS · Windows |
| VirusShare | MD5 against VirusShare's ~42.5 million malware hashes, worked out in the same pass so files are only read once. | macOS · Windows |
| Pattern rules | Tell-tale code and strings of malware families. On Windows these are YARA rules for download cradles, encoded PowerShell, AMSI bypasses, Defender tampering, credential stealers and more. You can add your own. | macOS · Windows |
| Behaviour rules | What a program does once it runs, and which files it opens: narrow rules for stealers, spyware, backdoors and miners, fed live by Apple's Endpoint Security. | macOS |
| Apple XProtect | Apple's own malware rules (about 580 YARA rules), run over everything a scan finds, including inside archives and on USB drives. | macOS |
| Program analysis | What an unsigned program is built to do: record keys, take screenshots, read passwords, hide, phone home. Only combinations that add up to malware are reported. | macOS |
| Script decoding | Base64, hex, escapes, character codes and split-up strings are decoded, up to three layers deep, before the rules look again. | macOS · Windows |
| Microsoft Defender (AMSI) | Windows' own antivirus checks scripts, documents and programs through the Antimalware Scan Interface, as one more engine. Only the content is passed; Agamemnon's quarantine does the rest. | Windows |
| Cloud check | Optional: unsigned programs are looked up in MalwareBazaar's live database by fingerprint only, never the file. | macOS |
| URLhaus | Where a download came from, against abuse.ch's live list of about 36,000 malware links. | macOS · Windows |
| ClamAV | Cisco's free engine as a second opinion. Agamemnon installs it and keeps its signatures up to date. | macOS · Windows |
| Code signatures | Gatekeeper and notarization on Mac, Authenticode and Windows security catalogs on PC. Unsigned, tampered and revoked programs are flagged. | macOS · Windows |
Built against the threats people actually face.
Behaviour rules written for the malware families spreading today, on top of the fingerprint database.
- Stopped in the actAMOS · FrigidStealerFake password prompts and browser updates, keychain theft and uploads of your files.
- Stopped in the actBanshee · Cuckoo · PoseidonVirtual-machine checks, secret screenshots and wallet theft.
- Stopped in the actRansomwareUnsigned programs that start scrambling your files are stopped within seconds.
- Stopped in the actSysJoker · crypto minersThe fake macOS update backdoor and miners that eat your CPU.
- Flagged for removalShlayer · Bundlore · AdloadAdware extensions and search hijacks, removed in one click.
- DetectedBeaverTail · KeyStealFake job-interview malware payloads and keychain stealers, plus startup-item alerts.
- Warned before it startsClickFix · fake CAPTCHAsPages that tell you to paste a command into Terminal or the Windows Run box. You're warned as soon as you copy it.
- Stopped in the actInfected USB drives · BadUSBMalware on drives is quarantined and the drive ejected; fake keyboards typing commands are caught.
- DetectedHidden droppersScripts that hide their download-and-run commands in base64, hex or split-up text.
Agamemnon 4.0 for Windows
The Mac's real-time protection, now on Windows.
The biggest Windows update yet. Every guard has its own switch on the new Real-time protection page, and Windows' own defences get a checkup.
- Files scanned as they're savedPrograms, scripts, shortcuts, installers and archives saved anywhere in your user folder are checked within a couple of seconds. Known malware goes straight to quarantine.
- Ransomware shieldWatches Documents, Desktop and Pictures. If files stop being real photos and documents, get a strange new extension or a ransom note appears, the unsigned program behind it is stopped and quarantined.
- Paste guard for Win+R tricksFake “I'm not a robot” pages make people paste a command into the Run box. Agamemnon recognises it the moment it's copied, warns you and empties the clipboard.
- USB protectionDrives and memory cards are scanned when connected. Files hidden behind shortcuts, programs named like photos and autorun tricks are caught, and infected drives are ejected.
- Security checkupDefender, firewall, BitLocker, Secure Boot, SmartScreen, UAC, Windows updates, Wi-Fi encryption and whether your Windows still gets security updates, each with a Fix button. Plus everything that starts with Windows and programs with updates waiting.
- Microsoft Defender as an engineThrough Windows' scan interface, Defender's own detections join every scan, like Apple's XProtect on Mac. Hidden scripts are decoded first.
- Camera, microphone and startup alertsWindows says which app turned on your camera or microphone, and Agamemnon tells you. New programs set to start with Windows are scanned and reported.
- Self-protectionSettings changed behind Agamemnon's back are put back, and you're warned when the hosts file blocks security sites or a Defender exclusion is added.
- Updates, scan logs and right-click scanningAgamemnon updates itself after checking the download's fingerprint and signature, keeps your last 50 scans, and adds Scan with Agamemnon to File Explorer.
Privacy.
Your files never leave your computer.
- No account, no telemetry, no uploads. Only fingerprints are compared, against lists stored on your device.
- Limited network use: downloading the malware lists, ClamAV and its signatures, and checking for updates. The optional cloud check sends only a file's SHA-256, never the file. No account needed.
- Open source. Every rule and every line of code is public under the GPL-2.0, so you can check what it does.
Built carefully.
An antivirus needs deep access, so it has to be careful with it.
- Least privilege. Scanning runs as you; the ClamAV engine that parses untrusted files runs without system rights.
- Safe archives. Members are extracted under random names, and size limits are enforced while copying, not taken from headers.
- Tamper-proof quarantine. Encrypted in chunks bound to their position, with the key protected by your Windows account.
- No false alarms by design. It never stops anything that is part of the system or signed by a known developer on its own.
- A helper that can't be turned against you. The Mac protection helper only watches and reports, and it only replaces itself with a copy signed by our own developer team.
Download and install.
Free, with no account. Pick your system.
macOS
- Download Agamemnon.dmg, open it and drag Agamemnon to Applications.
- First launch: open System Settings › Privacy & Security and click Open Anyway.
- Allow Agamemnon under Login Items if macOS asks, then give it and its helper Full Disk Access for full scans and real-time file monitoring.
On first launch it downloads its malware lists in the background (about 1.5 GB) and installs ClamAV. Altogether it uses about 1 GB of disk.
Windows
- Run Agamemnon-4.0.0-Setup.exe and approve the one-time UAC prompt.
- In the welcome guide, choose your language and click Use recommended settings.
- That's it. A green shield next to the clock means you're protected.
Upgrading from 2.0 or 3.0? Install 4.0 over it; settings, quarantine and the threat database are kept. From now on Agamemnon updates itself.
Honest about its limits.
No antivirus catches everything. Here is what Agamemnon can't do.
- It reacts within a second or two; it doesn't block in advance. Even with real-time monitoring on Mac, a program gets that moment before it's stopped. Blocking beforehand needs a special permission from Apple. Keep a backup.
- Known-malware lists only know what has been reported. Rules and ClamAV catch many new builds, but brand-new or heavily disguised malware can still get past.
- On Windows it works alongside Microsoft Defender and does not replace it. Keep Defender on.
- The first database download takes a while. ClamAV and MalwareBazaar protect you from the start; the full count climbs over the first hours.
Tip: keep your system updated and only install software you trust.
Protection that stays quiet until it matters.
Questions, a threat we missed, or a false alarm? Write to us.