Click here to Skip to main content
15,881,281 members
Please Sign up or sign in to vote.
1.24/5 (3 votes)
I am making an antivirus by using the signature based malware analysis technique. There are some points which I am going to include in my signature based scanner that how this scanner will work. I am going to write this program in C#.NET.

1. The scanner will scan by hashing the file and comparing the hash with hash list in database using MD5.
2. The scanner will only scan file size that below 50MB and will skip some file types like .txt/.rtf.
3. The scanner start scanning and firstly it will scan for all process and its module (dlls) and terminate it if found as malware.
4. Then the scanner will scan startup folder and registry entry in all possible startup places and if found, delete registry and file. For example C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
or
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
5. Search the local harddrive and delete malware if found.

I want to know, are these points are sufficient for the requirement of the antivirus scanner? Is there any source e.g book,link etc. by which i can understand more about signature based scanner?
Posted

1 solution

I think that it is a good starting point :)
Unfortunately every day there is a something new...
I suggest you to have a look to Clam Antivirus[^], it is an open source multiplatform antivirus project.
Then google and read security news (i.e. you may want look this[^]).
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900