Anti-Spyware coding

[AceSpy]

Hello,

I am given the job to create an anti-spyware, so the basic funda being scanning the running processes for spyware known executables, and on system scan scanning for files/folders in spyware database.

Problem: where do I get the spyware db that I can freely or at some minor charge use?

Thanks,
Zeeshan

[oofki]

I know there is a site that you could at least look through I cant remember it for the life of me though. You COULD do something like download programs like adware and spybot and run a scan with them and monitor what they are looking for using "processmonitor" which can be found on sysinternals website. You can specify filters to only look at registry/file access from a certian program.

I am not sure how legal it would be to use the definitions you compile from such an act though...

[encipher]

If this is going to be something that is truly independent then you may have to compile a database of known malware yourself, which is a huge task, and then figure out a method for identifing them (i.e. how your going to code the engine and what your going to use as signatures for the files...). Other then that, if you dont mind spending some $$$, you can check to see how much it would cost to purchase a database and what not.

I did a quick google and found this: http://www.emsisoft.com/en/support/malware/

I hope that helps

I was working on a similar project myself, but i was just compiling a database of non-malacious start up applications....

Im interested to see how it turns out

[nihil]

I would suggest that this is a waste of time?.................... the one thing that you can say about any pattern or signature based system is that it is obsolete before you have even finished loading it?

I think that encipher's approach shows more promise................ decide what should be allowed to run.............like application "A" runs processes "x", "y" and "z"................if "A" hasn't been started, neither should the others?

Also look for opening of ports and attempts to "phone home"...................