How to develop a scanner/disinfector?
Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: How to develop a scanner/disinfector?

  1. #1
    Junior Member
    Join Date
    Apr 2005
    Posts
    4

    How to develop a scanner/disinfector?

    Hello gang,
    I must say this is a very resourceful place that I'm glad to have found!
    I'm a newbie to security/antivirus area(aside from being able to use one of course) and as a school project I need to create a program that will disinfect one specific virus using a simple pattern matching technique. I ran into the open source ClamAV and have been reading about how to create signature files and add it to its db and it doesn't seem too bad even for a newbie like myself.
    But what I would like to be able to do is develop a standalone utility that will scan for a specific virus (just one strand for simplicity) and disinfect/remove it. There are tons of these type of utilities out there but I couldn't find any decent tutorial/documentation that could help me. I would appreciate any references or advises you may throw at me.

    Thanks in advance!
    Nick

  2. #2
    Senior Member
    Join Date
    Aug 2002
    Posts
    547
    well first of all welcome to AO
    you say that you need to create a removal tool for an spesific virus, well what i recomend is that you find the virus that youre intrested in working with, and learn the infection methods that the virus use among other information like

    *Registry keys that the virus changes/create/delete
    *if the virus creates copies of it self and were are they hidden
    *Start up method
    *Payload
    *if the payload damage or replace system files , witch are they

    I did a similar project in HS i made a VBS file that changed the IE home page, displayed a message avery time the computer was turn on. made copies of it self in several folders with diferent names etc. And also made another VBS files that undo everything delete the registry entrys the copies of the file And i wrote a report that explained both files and what disected and explained the code aswell. Im a little bit buzz right now. if you need help and think that i can help you send me a message.

    oh by the way do you have any coding experience?
    and i almost forgot most of the newer AV detect many scripts as malicius

  3. #3
    Senior Member
    Join Date
    Mar 2004
    Posts
    557
    Hi

    Maybe I am a bit old-school, but viri can be hidden in
    any executable. Maybe they create a registry key,
    so scanning for them is an idea (have a look at this
    thread[1] for how to scan the registry using c/c++)
    In addition to GrApHiCTrOn advices -

    I assume, that you have some basic knowledge of some
    programming language. I also guess, you want to scan
    files for simple virus signatures (a fixed set of
    bytes), without some polymorphic behaviour?

    Then, why not scan the hardisk(s) for executables,
    like (exe, com, scr, ...) using FindFirst/FindNext,
    open them (e.g. ifstream) as binaries, jump to the
    assumed position and compare byte for byte with
    the "signature"? This sounds more horrible than it
    is - it can be implemented quite efficiently.

    Cheers.

    [1] http://www.antionline.com/showthread...light=registry
    If the only tool you have is a hammer, you tend to see every problem as a nail.
    (Abraham Maslow, Psychologist, 1908-70)

  4. #4
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,884
    The king of pattern matching is PERL. Write a small util that can remove an old virus that has a static payload. Once you're done, run it through PERL2EXE and presto, you have a portable scanner that will run on boxes w/o having to install PERL. Yes, this works wonderfully.

    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

  5. #5
    Junior Member
    Join Date
    Apr 2005
    Posts
    4
    Thanks for the insights guys, you have really shun some light in the tunnel

    GrApHiCTrOn, I don't think VBS would cut it because I expect this utility to be run on an environment that may have an AV software running.

    As far as my programming experience goes, i have a decent knowledge of java, and still remember c++ from few years ago. But I'm pretty sure I can pick up any language that proves to be efficient.

    Originally posted here by sec_ware

    I also guess, you want to scan
    files for simple virus signatures (a fixed set of
    bytes), without some polymorphic behaviour?
    This is exactly what I had in mind since pattern matching doesn't work on a polymorphic virus.

    Originally posted here by sec_ware

    Maybe I am a bit old-school, but viri can be hidden in
    any executable. Maybe they create a registry key,
    so scanning for them is an idea (have a look at this
    thread[1] for how to scan the registry using c/c++)
    This is exactly how I imagined it as well, I know I would need to search the actual files and clean them and also need to correct any modifications done to the registry. I'm guessing scanning the registry would have to be done by means other than VBS since that would upset most AV programs although it is extremely simple that way.

    Originally posted here by thehorse13
    The king of pattern matching is PERL. Write a small util that can remove an old virus that has a static payload.
    From what I gathered after reading this, I think I will end up going with the Perl route. One thing I am not clear on is, would I not need a parser for each file format (ie. exe, com, bat...) that will be scanned so that the utility knows what its looking at? any ideas here would help because I'm feeling clueless.

    Thanks again everybody for your inputs!

  6. #6
    Senior Member
    Join Date
    Oct 2003
    Posts
    394
    Most of avīs like kaspersky and norton and some other can detec most of windows programs that requid access to internet. (i think that it is standard code string or few from different compilers)

    Scriptīs may ofter use copy/move/delete functions (most important i think that script not dirrected on "windows install folders" and not doing operations on "dll,exe, and other executables", not writing to socket and "IE registry","outlook registry", not creating other scripts)

    to protect windows "standard" files you can use pattern of known good files (name,size or check sum) i think that it is faster way to detect dmg/infec/replaced windows files , something like "sfc /scannow" and CD.

    ----
    i was also thinking about to create somthing like this but i have not time.....
    ----

    good luck
    // too far away outside of limit

  7. #7
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    to protect windows "standard" files you can use pattern of known good files (name,size or check sum) i think that it is faster way to detect dmg/infec/replaced windows files , something like "sfc /scannow" and CD.
    Ahh... So you are saying that every time windows updates you'll get a "virus" alert? OK... that seems reasonable...

    You don't seem to know how things work.... Until you do it might be a _really_ good idea to keep your knowledge and experience a secret... 'kay?

    "Name" will produce a failure when you try to access a known named file....

    "Size" is irrelevant.... trust me on that....

    "Checksum" is so easily subverted it's not true....

    Try Googling SHA1 or SHA2 or a simple MD5 hash.... then you are going down the right road....
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  8. #8
    Senior Member
    Join Date
    Oct 2003
    Posts
    394
    for fast scan can worksome av does)
    no, but it is good to notife changes in the system files b4 using of virus patterns if changes has been detected can pattern for virus be used it makes AV faster, not nessesery to restore files if "version" missmatch, with AV.

    for full scan can be used just patterns of viruses
    ---------------------------------------

    does it good/effectiv to detect files with same names or same "body" in the different startup locations in the registry?

    does it good/effectiv to detect files with same names or same "body" that are alredy runing from different locations?
    // too far away outside of limit

  9. #9
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,884
    LOL, MrBabis, have you been in the sauce? I thought that teachers can't drink on the job.

    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

  10. #10
    Junior Member
    Join Date
    Apr 2005
    Posts
    4
    Is it possible to do binary comparison using Perl (as opposed to string comparison)? I was thinking of opening each type of file (exe, com, bat...) and comparing the assembly code to the binary signature.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •