AV

azure0wind

Well-Known Member
OP
Member
Joined
May 24, 2009
Messages
937
Trophies
1
XP
345
Country
Indonesia
So.. im making an anti-virus. Currently it will be made by Visual Basic 2008 / 6. So anyone interested to join. My current virus database:
===
FlyFF666.dll.vbs:
>Will hide all drives, Disable Control Panel, Disable right-click menu, Disable Task Manager, Disable CMD.
===
Anyone interested?
 

Thoob

LOLmonade.
Member
Joined
May 28, 2009
Messages
1,122
Trophies
0
Age
29
Location
Scotland
Website
Visit site
XP
125
Country
What? You're making a virus or an anti-virus? I couldn't really understand your post...
unsure.gif
 

Rydian

Resident Furvert™
Member
Joined
Feb 4, 2010
Messages
27,880
Trophies
0
Age
36
Location
Cave Entrance, Watching Cyan Write Letters
Website
rydian.net
XP
9,111
Country
United States
The problem being a simple scanner will never be effective anymore. Modern antivirus programs literally hook into the kernal to redirect reads/writes so they can scan any file that's downloaded/saved/made before the user has a chance to run it (or something like explorer or another program tries to read it to index info about it, if the virus exploits that), and scans any executable that's set to run before it actually runs.

Compared to that, a normal scanner won't be effective at all.
 

azure0wind

Well-Known Member
OP
Member
Joined
May 24, 2009
Messages
937
Trophies
1
XP
345
Country
Indonesia
so anyone interested to join. i know im lack at experience and i can make simple scanner, that will detect word virus for example...
 

Thoob

LOLmonade.
Member
Joined
May 28, 2009
Messages
1,122
Trophies
0
Age
29
Location
Scotland
Website
Visit site
XP
125
Country
Well if it is an anti-virus, I doubt there will be any interest as there are already many great free anti-virus programs like MS Security Essentials that people will use instead of yours. If you think yours will work better though, then make it just for yourself.
 

FAST6191

Techromancer
Editorial Team
Joined
Nov 21, 2005
Messages
36,798
Trophies
3
XP
28,375
Country
United Kingdom
If this is going to be a one man gig/small team effort I would instead suggest you make a heuristics module rather than a signature detection not least of all because signature detection has barely worked for about 10 years now and even if you did believe in it a good database is millions of entries large (most people making new ones will buy an old AV company/rights to a database and work from there).

Usual heuristic checks are directory access, monitor certain key directories and registry entries (especially startup and in event of* , scan for runtime compression (I find this is what often triggers false positives so be careful), network access (granted this is firewall territory), hooks that are added, many programs are still static so binary overwriting can be a useful flag, maybe also consider a sort of sandbox mode (a safe installer/uninstaller would be great) and while you are at all of this you will want to harden your tool against the malware itself (usually by using the same/similar techniques to the stuff you are trying to defeat).

For bonus points you might consider a malware cleaner (indeed 7zip often works for me here) to rid people who like keygens and similar little programs of the small 7 kilobyte loader type malware that they get wrapped in between the scene and the places us plebs find stuff.

*my most disliked malware at the moment are the false AV programs (XP Security Tool 2010, XP Defender Pro, and Vista Security Tool 2010 to name 3 of them) that change the way executables are run among other things.

Better yet you could go the opposite way and secure systems/provide a means to do it- windows 2K and XP SP2 have now ceased support and as such could do with a few tweaks in that direction (see some of the stuff people did to windows 98) similar to the things like XP tweaker but with a large focus on security.

"Or you can post the virus source here"
Such a thing is not so good (not least of all because it would be a skiddies wet dream)- the best you can really do here is a virus toolkit.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    S @ salazarcosplay: @Megadriver94 I think the 3d printer should have been called something else instead of a 3d printer