Click here to Skip to main content
15,557,873 members
Please Sign up or sign in to vote.
4.67/5 (3 votes)
See more:
Hi,

I am working in an anti-virus company.
My job is to scan and remove malwares from the chat messages like phishing links of all available messengers like google, AIM, MSN,yahoo etc.
If I drop those malware packets I need to display our message in chat window through code.
How is it possible to write on chat window of yahoo, AIM, MSN etc in code. I wanted to know the method and which language should I use to achieve this task.
Posted
Comments
[no name] 9-Jun-11 9:20am    
If you are able to catch any chat message send to user, than you can change that message.

Why should you drop the packet?

You may write to your program log and, if user selected this, display pop up message in right bottom in the screen.

In what way do you capture chat messages?
champ23 10-Jun-11 2:08am    
Hi,

Thanks for the suggestion. We are capturing messages using NDIS filter driver.
This is tedious task to get the content of message, as each messenger message sending format is different.
Is it possible to capture messages above NDIS level, at application level and block it.

You can write an executable that scans any file that's being passed to it's command-line. Most of these messenger-apps provide a configuration-option that allows the user to identify their virus-scanner. They'll invoke it whenever something is downloaded.

"Hooking" into each messenger-app is not possible; they don't provide a common public interface, and might not use the same messaging-protocol.
 
Share this answer
 
Comments
Monjurul Habib 9-Jun-11 15:35pm    
nice advice, my 5
champ23 10-Jun-11 2:17am    
hi,

"You can write an executable that scans any file that's being passed to it's command-line."
I didn't understand the above line. How do we get the file passed to messenger command-line.

"Most of these messenger-apps provide a configuration-option that allows the user to identify their virus-scanner. They invoke it whenever something is downloaded."
How can we achieve this, can you give some example or method to do this.
Eddy Vluggen 10-Jun-11 9:14am    
# How do we get the file passed to messenger command-line.
That depends on the messenger that you're using. For the MSN Live Messenger, sign in, go to the menu "Extra" and then select "Options". Go to the tab "File Transfer", and select the console-application that you want to use to scan incoming files. That's specifically there to allow the end-user to specify which virusscanner they want to use with their messenger.

# How can we achieve this, can you give some example or method to do this.
Create a console-application that scans each file that's being passed as a argument. Then configure the messenger to use that; each messenger-application will have it's own unique way of configuration.

# can you give some example or method to do this.
There should be someone in the antivirus-team that knows how to create a console-application.
champ23 13-Jun-11 9:58am    
The solution which you have is manual. Here user has to give our scanner path
to messenger, which we don't want. The scanner should automtically get notify the file attachment when the messenger receive file.
How is that possible.
Eddy Vluggen 13-Jun-11 17:18pm    
No, it's not. If you set the configuration once, WL Messenger will scan every incoming file with that particular executable.

Yes, they will have to set the path once. You might to seek where the path is stored (registry perhaps) and modify it, but these things tend to change between different versions - so there's no guarantee.
There are several methods of packet capture.
But you must to control packet and then use network hoohing.
Netowork hooking in windows(XP) is consist of TDI and NDIS.
For using TDI and NDIS, you must develope drivers using WDK.
If it is too difficult to you,I recommend to use winpkflt.
 
Share this answer
 
Comments
[no name] 14-Jun-11 4:14am    
srajput: "what do you mean by "you must to control packet and then use network hooking""
Lois Reonardo 15-Jun-11 3:54am    
It means that you can modify or build packet not capture.
If messege body is spam or virus then you alarm to user,ro remove it.
I have put your message to comment.
 
Share this answer
 
v2

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900