Click here to Skip to main content
15,921,156 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I have read some articles about viruses and when the first viruses came into effect (ELK CLONE) but since then viruses have become more and more advanced and for this reason I would like to know what type of signature a virus scanner uses to find viruses and maybe a real breif explaination of how to start it in VB?
Posted

1 solution

What is being called a virus signature is a actually a very complex thing. Checking an unalterable file like an executable, can burn this down to checking an MD5 hash. Other files like word ,excel and other MS Office related files are much harder because the executable macro content has to be checked for common attack.
To condense my answer a bit I'll state this:
- MD5 for content (programs) that do not change
- pattern recognition of viruses in whatever form the may appear
(and this is the really complex and convoluted part
which makers of anti virus software make you pay dearly for :)
)

cheers


Manfred
 
Share this answer
 
v3
Comments
Dale 2012 24-Nov-10 19:25pm    
ok so in short your saying "pure MD5" is the signature to use when trying to detect viruses within programs that do not change? and pattern recognition could be created by a set of circumstances that say if action = true and action1 = true flag as suspicious file?
Dale 2012 24-Nov-10 19:26pm    
What is the difference between pure MD5 and MD5 alone?

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900