Add DOWN security scanner v0.2 with quarantine and browser fix #3984

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/48co.v1/pull/53

Summary

This PR introduces the complete DOWN security scanner application - a lightweight, Rust-based Windows security tool that detects and removes malware, scareware, and potentially unwanted programs (PUPs). The scanner includes six detection modules, quarantine functionality, browser hijacking remediation, and signature-based threat detection.

Key Changes

Core Application Structure

• Main entry point (main.rs): CLI-driven scanner with support for full scan, quick scan, nuke mode (aggressive removal), browser fixing, quarantine management, and signature updates
• Threat model (threat.rs): Defines threat severity levels, categories, and actionable responses (kill process, quarantine file, remove startup entry, uninstall program, manual review)
• Elevation handling (elevation.rs): Windows UAC elevation support for privileged operations

Detection Modules (6 scanners)

1. Processes (scanner/processes.rs): Detects known malware processes, suspicious execution paths, and cryptominers via CPU usage thresholds
2. Startup (scanner/startup.rs): Scans Windows registry Run keys and startup folders for persistence mechanisms
3. Files (scanner/files.rs): Identifies double-extension files (e.g., invoice.pdf.exe), known malware hashes via SHA256, and suspicious executables in temp/download directories
4. Browser Extensions (scanner/browser.rs): Audits Chrome, Edge, and Firefox extensions against known malicious IDs and excessive permission patterns
5. Network (scanner/network.rs): Checks hosts file tampering, DNS configuration, and connections to known bad IPs/domains
6. Scareware (scanner/scareware.rs): Detects fake antivirus, fake optimizers, and Defender tampering attempts

Threat Management

• Quarantine system (quarantine.rs): Moves detected threats to a safe quarantine directory with JSON manifest tracking (ID, original path, threat name, timestamp). Supports file restoration by ID
• Browser fixing (browser_fix.rs): Resets hijacked homepages, search engines, and removes malicious extensions
• Reporting (report.rs): Colored terminal output with threat summaries and log file generation

Signature Database

• Process names (signatures/process_names.rs): 100+ known malware/scareware process signatures
• File hashes (signatures/hashes.rs): Known malware SHA256 hashes (WannaCry, etc.)
• Extension IDs (signatures/extension_ids.rs): Malicious browser extension identifiers with permission analysis
• IP blocklist (signatures/ip_blocklist.rs): Known C2 infrastructure, mining pools, and phishing domains

CLI Features

• --scan: Full system scan across all modules
• --quick: Fast scan (processes + startup only)
• --nuke: Aggressive removal mode with admin elevation
• --quarantine: Scan and quarantine all threats
• --list-quarantine: Display quarantined items
• --restore <ID>: Restore a quarantined file
• --fix-browser: Remediate browser hijacking
• --update-sigs: Download latest threat signatures

Notable Implementation Details

• Cross-platform awareness: Windows-specific code (registry, UAC, taskkill) is gated with #[cfg(windows)] macros; graceful fallbacks for non-Windows systems
• Safe file operations: Quarantine uses copy+delete fallback when rename fails (handles cross-filesystem moves)
• Efficient scanning: Configurable depth limits and file size thresholds to avoid performance degradation
• Manifest persistence: JSON-based quarantine tracking with atomic save operations
• Colored output: Rich terminal UI with status indicators (✓, ✗, ~, !) for user clarity

https://claude.ai/code/session_011nKTaokxXRNf4W53MVMjqW