PC_Workman / blog
Friday Shipped & Scarred · #8

I Wanted to Suspend Processes. I Built a Mini Anti-Virus.

One innocent safety feature slowly turned into the early foundation of a small offline anti-virus.

By Marcin Firmuga·2026-05-15·2 min read·Friday Shipped & Scarred #8

I wanted to suspend a few background processes. Instead I built a mini offline anti-virus.

Monday's plan was calm. Friday got… great.

Shipped

Scarred

While building Process Guard I added a simple legitimacy check: does chrome.exe actually live where Chrome should live, or is it running from %TEMP%? Then I tested obvious spoofs — svch0st.exe, expl0rer.exe, winlogonn.exe… and the check immediately started flagging them. One innocent safety feature slowly turned into the early foundation of a small offline anti-virus — based on path, behaviour and spoof detection. Completely unplanned.

Also lost hours fighting Polish Windows CP852 encoding hell — one single byte (0x98) broke the entire power-plan system. Classic.

Second week in a row shipping more than planned. Feels weird… but really good. Still doing Żabka shifts. Still building.

BuildInPublicPythonPC_Workman
This is the project behind the post. PC Workman is a free, open-source Windows system monitor with an offline AI assistant - everything described here is real, shipped code. Download it or read the source.
← #7Not Scarred This Week - Everything Shipped
MF

Marcin Firmuga

Solo developer · HCK_Labs · building PC Workman in public

Every edition is written from that week's real commits. Newest posts premiere on LinkedIn - the archive lives here. More about me: my story.