HauntTrace: A Guardian Ghost That Watches Your PC for Bad Spirits 👻

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Quick, honest question. Has this ever happened to you? 👇

Your laptop fan suddenly sounds like a jet engine. Everything feels slow. You open Task Manager, and you see a long list of names like svchost.exe, llama-server.exe, RuntimeBroker.exe... and you have no idea which one is the problem, who made it, or if it's safe to close. 😅

So you do what everyone does. You close the one with the scariest name and hope for the best. 😂

When I saw the Ghost in the Machine theme, I immediately thought about this. My PC really does have ghosts. Programs that keep eating memory, programs that crash and come back, programs that stay busy for hours when I'm not even using them.

So I asked myself one question:

What if my PC had a friendly ghost that watched for the bad ones, and actually told me what was going on?

That question became HauntTrace, a pixel-art guardian ghost for Windows.

Your PC becomes a small haunted house with one guardian ghost living in it. When a real program starts misbehaving, it shows up in the room as a bad spirit. Each spirit's name explains what it's doing:

• 👹 Poltergeist: won't stop rattling the CPU
• 😱 Banshee: screams in sudden CPU bursts
• 🤢 Glutton: keeps eating memory
• 💀 Revenant: crashes and keeps coming back
• 😐 Lingerer: has been busy for hours and won't leave

There are a lot of tools that show you numbers. I wanted something that explains the numbers like a friend would, and never scares you for no reason.

What it can do

1. The room reacts to your real PC. The haunt meter follows your actual total CPU and memory. Calm PC, calm room. When things get heavy, the room turns red, the candle flickers, and the spirits move in.

2. It tells you who a spirit really is. Tap a spirit and the guardian checks its digital signature, version info and folder. In my demo, the Glutton was Google Chrome, signed by Google LLC, and its memory went from 155 MB to 481 MB in about 15 minutes. That's a real reading from my laptop, not a mockup.

3. Unknown never means malware. This was really important to me. If a program has no valid signature, HauntTrace says so, and then adds: "Many small tools are unsigned; unknown doesn't mean bad." It never calls anything a virus. It's an investigator, not an antivirus.

4. The lantern investigates with local AI. Press Lantern, and the guardian investigates with Gemma running on my own laptop through Ollama. Gemma can ask for read-only checks (process details, parent process, resource history, signature, related processes), gets the real results back, and then rethinks. At the end, it tells you what it found in plain words, and how sure it is.

5. Every finding shows its proof. Press Show the proof and you see exactly what was measured: CPU, memory, how long it's been running, who launched it. If a claim can't be linked to real evidence, it gets marked as unverified. And when the AI can't reach a conclusion, it honestly says "the cause has not been established" instead of making something up.

6. Sweep the house. Sometimes you don't want to wait for a rule. You just want to know "why is my PC slow right now?" One tap on Sweep the house shows the busiest programs at this moment. Pick one, and it becomes a Shade you can inspect, investigate or deal with. (Yes, there's a spooky "Wooooo" when you summon it 👻)

7. You decide. Always. Every spirit has four moves: Lantern (investigate), Befriend (trust it, never flag it again), Shoo 1h (snooze it), or Banish (close it, but only after a second confirmation). HauntTrace never closes, deletes or changes anything by itself.

8. The guardian can talk. With voice turned on, the guardian says its alerts and findings out loud. You can pick Windows voice (built-in, works offline, no key) or ElevenLabs for a more natural voice. My ElevenLabs API key is saved in Windows Credential Manager, not in a file, and only the short sentence the ghost is about to say gets sent. Never my process list.

9. You can ask the guardian. Every spirit card has a small "Ask the guardian about it…" box. Gemma answers only from what HauntTrace actually recorded about that spirit, and says when it doesn't know.

Demo

Code

royalharry007 / HauntTrace

A pixel-art guardian ghost that watches your Windows PC for bad spirits. 100% local AI with Gemma via Ollama.

HauntTrace 👻

A lightweight ghost in your system that spots lingering activity, warns you with a spooky alert, and shows you what's behind it.

HauntTrace is a native Windows desktop app (Tauri 2 + Rust + React). Deterministic rules watch process activity through Win32 APIs. When something lingers, a local alert and an original spooky tone fire immediately. You can then press Investigate, and a locally running Gemma model works through the evidence in a bounded, auditable loop. It requests read-only checks, receives their real results, revises its hypotheses, and writes a report in which every fact links back to collected evidence. ElevenLabs can optionally give the ghost a voice.

Built for the Hacktoberfest Open-Source AI Challenge, Week 4: Ghost in the Machine.

HauntTrace is an investigative assistant, not antivirus software. Unusual activity is not proof of anything malicious, and HauntTrace never says otherwise.

---

Why open-weight AI

…

View on GitHub

Want to try it? Download the installer from the latest release (about 3.3 MB, no admin needed), or grab the portable zip if you don't want to install anything. For the AI lantern, install Ollama and run:

ollama pull gemma4:e2b-it-qat

No Ollama? No problem. Alerts, identity checks and evidence still work without it.

The installer isn't code-signed yet, so Windows SmartScreen may say "Windows protected your PC". Click More info → Run anyway. (Yes, I see the irony of an app that checks signatures being unsigned 😂)

How I Built It

The open-source AI at the core

The lantern's brain is Gemma 4 E2B (gemma4:e2b-it-qat), Google's open-weight model, running locally through Ollama. I picked it because it's small enough for a normal laptop but still good at structured output and reasoning over evidence. If your laptop is weaker, you can switch to gemma3:1b in Options.

But here's the thing. Process data is sensitive. Program names, folders, what's running and when... I didn't want an AI that just guesses about my PC. And I definitely didn't want one that can do things to my PC.

So I made one rule: Rust measures. Gemma reasons. You decide.

Detection is not AI. The five spirits come from deterministic rules in Rust, reading real data from Win32 APIs every 5 seconds. For example, a Poltergeist needs at least 25% of total CPU for 12 samples in a row (about one minute). A Glutton needs memory to grow by at least 50% and at least 300 MB over 15 minutes. A Revenant needs 3 restarts within 10 minutes. These rules have hysteresis and cooldowns, so one short spike doesn't spam you.

The lantern is a bounded loop, not a free agent. When you light the lantern:

1. HauntTrace collects the first evidence (what the rule measured, process details, resource history).
2. Gemma gets a small evidence packet and replies in a strict JSON schema: what it thinks, which evidence supports it, what's missing, and up to 2 checks it wants to run.
3. The app validates every request. Gemma can only pick from 7 read-only tools, and only for processes that are already part of this investigation. There's no tool that takes a file path, URL, command or script. Invalid requests get rejected and logged.
4. Valid checks run, the results become new evidence, and Gemma thinks again.
5. The loop stops after 4 steps, a 300-second budget, or when you press Stop.
6. Gemma writes the report. The app then checks it: facts without real evidence become unverified claims, "high" confidence needs at least three linked facts, and anything that would weaken security is removed.

And if Gemma isn't available? The engine runs the standard checks anyway and writes an evidence-only report. You can actually see this in my demo video: the proof says "no AI conclusion was reached, so the cause has not been established." I left that in on purpose, because that's what HauntTrace is supposed to do when the model doesn't give a valid answer. It doesn't invent a reason. When Gemma does answer, I tested the full loop end to end (real process, real Win32 data, real Gemma), and it passed 3 out of 3 runs with gemma4:e2b-it-qat.

Safety rules I didn't want to compromise on

• HauntTrace never closes, deletes or changes services, startup entries, the registry or security software by itself.
• Banish needs a second confirmation, and right before closing, it checks the process is still the same one (not a reused PID).
• It runs without admin rights. Protected processes show up as "access denied", never as suspicious.
• The Ollama address must be on my own machine (127.0.0.1 / localhost), so evidence can't be sent to a hosted model, even by mistake.
• The ElevenLabs key lives in Windows Credential Manager, and a check:secrets script makes sure no key ends up in the repo or the app bundle.

Making it light enough to leave running

A guardian that slows down your PC would be a pretty bad guardian. 😂 With the window closed, HauntTrace keeps watching from the tray using about 0.14% of one CPU core and 29 MB of memory on my PC. Closing the window destroys the WebView completely, and Gemma only runs when you light the lantern.

Tech stack 👩‍💻

• Gemma 4 E2B + Ollama -> the lantern's brain (open-weight, local)
• Rust + Tauri 2 -> process monitoring (Win32 APIs), detection rules, investigation engine, signature checks
• React + TypeScript -> the pixel-art haunted house, drawn with my own pixel sprites
• SQLite -> local alerts, investigations and evidence
• ElevenLabs (optional) -> the guardian's natural voice
• Windows voice -> offline voice with no key
• 68 Rust tests -> detection rules, PID reuse, rejected tool requests, malformed AI output, cancellation and more

Why Does Open Innovation Matter?

A process monitor sees a lot about your computer. Every program you run, where it lives, when it started, what launched it.

With a closed API, all of that would have to be uploaded to someone else's server just to ask "why is my PC slow?". That didn't feel right to me. With an open-weight model running locally, nothing leaves my laptop. Gemma reads the evidence on my own hardware, it works offline after the first download, and it costs nothing to run.

Open weights also gave me choice. A bigger laptop can use the default Gemma 4 model, and a smaller one can use gemma3:1b. And because HauntTrace itself is open source (MIT), anyone can read exactly what the ghost collects, what it sends (nothing, unless you turn on voice), and what it's allowed to do. An app that watches your PC should never be a black box. Including to me.

The Spirit of It

Most PC tools that watch processes are scary on purpose. Red warnings, "THREAT DETECTED", big alarm sounds. And most of the time, the "threat" is just Chrome being Chrome. 😂

I wanted the opposite. A ghost that is on your side. One that says "I found a few clues, but we haven't established why it's happening yet" instead of pretending to know. One that says "unknown doesn't mean bad" instead of making you panic.

The best part is that the spooky theme isn't just decoration. The names actually help. "Glutton" explains memory growth faster than any graph. "Revenant" explains a crash loop in one word. Even someone who has never opened Task Manager understands what a ghost that "keeps eating memory" means. 👻

Prize Categories

• Best Use of Gemma: Gemma 4 E2B runs locally through Ollama as the lantern's brain. It requests read-only checks, gets real evidence back, rethinks, and writes a report where every fact links to that evidence. It also answers the "Ask the guardian" questions, only from what was recorded.
• Best Use of ElevenLabs: gives the guardian ghost a natural voice for its alerts, findings and answers. The key is stored in Windows Credential Manager, and only the short sentence being spoken is sent, sanitized, never the process data.

Thanks for reading! If your PC had a guardian ghost, which bad spirit do you think would show up first? I'm betting it's a Glutton named chrome.exe. 👻