Making a working antivirus is a very hard thing because of several reason:
Today, I'm going to show you how to make a simple malware scanner (not antivirus) in MSVC2008 C/C++ which use hash to compare file with database. This methods only works on some kind of malware, eg. worm, trojan, or any file which doesn't change itself because we will hash the whole file content.
Read More...
- You need to get virus/malware sample which is not easy to get.
- Most virus infect the executable file and some use polymorphism making it harder to detect.
- Most antivirus use heuristics scan which analyze the file and if the file look suspicious it will flag it and ask the user what to do. This is hard to implement and poor heuristics scan can result many false-positive.
- Need a driver which will monitor the system like file read/write.
- etc...
Today, I'm going to show you how to make a simple malware scanner (not antivirus) in MSVC2008 C/C++ which use hash to compare file with database. This methods only works on some kind of malware, eg. worm, trojan, or any file which doesn't change itself because we will hash the whole file content.
