PolinRider Scanner

    Download

    Scan for PolinRider: quick start

    For polinrider 3.0.x latestBy Mandeep Singh · Updated

    On this page
    1. Install it and run it
    2. Or download it and verify it yourself
    3. The first question
    4. If it finds something

    polinrider is one free program that checks this computer, a folder, a GitHub account or a whole organization for the PolinRider malware. Install it, run it with no arguments and answer its questions. It changes nothing until you type yes, and everything else on this site can wait until it has told you what it found.

    Install it and run it

    macOS

    brew install meSingh/tap/polinrider-scanner
polinrider

    Linux

    brew install meSingh/tap/polinrider-scanner
polinrider

    On Debian or Ubuntu you can use the .deb from the latest release instead.

    Windows

    scoop bucket add mesingh https://github.com/meSingh/scoop-bucket
scoop install polinrider-scanner
polinrider

    The package managers put the program and its indicator set in place for you.

    Or download it and verify it yourself

    1. Download the archive for your computer from the latest release: macOS (Apple silicon or Intel), Linux (x86_64 or arm64) or Windows (x86_64).

    2. Check that it is genuine:

      sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify polinrider-v3.0.0-macos-arm64.tar.gz --repo meSingh/polinrider-scanner

      For a release from before 3.0.0, see Verifying releases from before 3.0.

    3. Unpack it and run it with no arguments:

      tar -xzf polinrider-v3.0.0-macos-arm64.tar.gz
cd polinrider-v3.0.0-macos-arm64
./polinrider

    Keep the ioc/ folder beside the program. It is the indicator set, and the program refuses to scan without it.

    On macOS, Gatekeeper stops the first run, because the program is not notarised. Once you have verified it, run xattr -d com.apple.quarantine ./polinrider.

    On Debian and Ubuntu, releases since 2.1.0 also carry a .deb for x86_64 and arm64. Verify it the same way, then run sudo apt install ./ followed by its file name.

    The first question

    It asks what to check. Answer with a word, never a number.

    Answer What it checks
    computer This computer: your whole home folder, what starts by itself, shell startup files, git and npm settings, running programs and open connections
    folder One folder of code. It suggests the code folders it finds
    organization Every repository, branch and tag of a GitHub organization
    account The same for your own GitHub account
    everything This computer first, then GitHub

    Type q to leave at any point.

    If it finds something

    Not sure what a result means? Is it PolinRider or a false alarm?

    Last updated:

    Edit this page on GitHub