the engine of an AV

[gh0st]

well guys Im trying to code a basic AV so but first Im learning the language cause Im new on it but I will learn it quickly so Ive seen some stuff on wikipedia about the way how an AV(AntiVirus) reads the file to look for the malware now lets get onto programming terms well the first thing that goes to my mind is to use a library class (I dont know if thats well spelled) which will work as a reader of the file which is infected so any advice ? Im coding it into java cause its multiplataform.
any advice will be well appreciated thanks in adnvace

[Kulverstukas]

Get the source Kaspersky, mod it and canll it gh0stPersky
Nah, really, like someone said already on the forums, it would be a lot more work keeping it up to date then making an AV.
If it's for learning then go for it although not sure I will use it, lol.

[ca0s]

An AV is composed of several components:
- Static analyser: it looks into files for "signs" (chunks of data classified as "evil").
- Run-time analyser: it monitorizes what every app is doing in every moment.

You will need to load a kernel module if you want it to be effective, and set hooks to a lot of functions. Idk if java lets you do all those things. You can start by doing a static analysis, tho.

[gh0st]

okay ca0s nice intro dude Im searching some info well and Ive found this wikipedia :3 http://en.wikipedia.org/wiki/Digital_signature so the AV have to look for the signature which is from the viruses and have to delete it now what happen if the virus use an encryptation? there is where the war of algoritms start? I mean cause until I know exists something that we name FUD right?

[ca0s]

You don't have to delete the signature. The signature is just a chunk of bytes which presence is suspicious. Deleting it you don't remove the malware part of a file.
If the virus is encrypted, you will find signatures of that encryption, and sometimes you will be able to decrypt it from code.
You will need a database with signatures... That will be the worst part. You can try picking one from another AV.

[PiZZ4]

Try looking into behavioral antivirus software.