[TazzyOpz]

[img]http://www.clamav.net/img/clamav-trademark.png[/img]

Since all I see getting released in this section is usually malicious. I decided to share this Source Code I had found on GitHub a few months ago by the user Fahminlb33.
This wrapper works perfectly with the ClamAV Engine 0.98.1.

I'm not sure if the user from Github has edited the source since the last time I've used it. But there was a bug in the original source code.
Once you update the Engine from ClamAV it will break the Signature Loading Process. I'm not sure why but the way they load signatures may be different in ClamAV Engine 0.98.6.
You will have to modify the source to work with the newest ClamAV engine which is 0.98.6. The one provided only currently works with 0.98.1 (However Not much has changed between the 2 versions)

ClamAV File Scan Example:


You will need to download the ClamAV Virus Definitions Separately
Which can be found here: http://www.clamav.net/download.html and looking under the "Set Up Freshclam" unstructions.
And just in case I get asked the 0.98.6 Virus engine does not interfere with the Virus definitions. So you can update them when ever you want.

GitHub/Source Code Link

If I forgot to add something I will add it to the thread tomorrow.
I hope someone finds this useful 🤝

[+Haze]

If your Antivirus took a heuristic approach at detecting viruses then let me know, I'd defiantly like to learn from it. I mean, I've never seen an a half decent Antivirus coded in .NET, but hey.

[Ninja]

"Virus Name: CLEAN"
Doesn't it have to say "Status: CLEAN" or "Virus Name: filename.exe"?

[еlixir]

I wouldn't call this a complete antivirus as it uses ClamAV to do all the dirty work. But thanks for this.

[TazzyOpz]

If your Antivirus took a heuristic approach at detecting viruses then let me know, I'd defiantly like to learn from it. I mean, I've never seen an a half decent Antivirus coded in .NET, but hey.

This is using the ClamAV engine. I believe there might be heuristics Methodology in place I'm not entirely sure. You could learn from this source a lot. There are ways to call for mail filtering and malicious url scanning which I thought was really cool. It also has a .rar/.zip unpacker so it scans inside of archives. There's quite a bit u can learn from it but I can't give u an exact yes or no whether the engine has heuristics in place. 🤝

"Virus Name: CLEAN"
Doesn't it have to say "Status: CLEAN" or "Virus Name: filename.exe"?

As stated above this isnt my source code. It was by the user on github I'm just sharing it since it had seemed to go un-noticed and I thought it was pretty cool

I wouldn't call this a complete antivirus as it uses ClamAV to do all the dirty work. But thanks for this.

The source it's self isn't an antivirus however it could be easily transferred Into one if someone wanted to do so. Libclamav.dll does most of the dirty for u as stated you would just use the GUI to update what's happening. I would like to see someone build off of this since I dont have the time due to work. It would be nice see something along the lines of this getting passed around rather the. Always seeing "keylogger source... And RAT source.. And RunPE injection.. Etc..."

[еlixir]

I agree. Being a crypter developer myself, i would love to develop an AV. As i know some tricks of the trade and it gives me a challenge. But realistically, an AV in .net wouldn't work because malware could just uninstall the .net framework LOL.

[+Haze]

But realistically, an AV in .net wouldn't work because malware could just uninstall the .net framework LOL.

LOOOOOOL made me chuckle.. That would be a very cheeky malware.

[TazzyOpz]

I agree. Being a crypter developer myself, i would love to develop an AV. As i know some tricks of the trade and it gives me a challenge. But realistically, an AV in .net wouldn't work because malware could just uninstall the .net framework LOL.

True to an extent. However I believe Avast actually has some pieces that rely on the .Net FrameWork. I know there are a few Anti-Viruses that use the .Net FrameWork in some way. I know for a Fact Malware Bytes uses the .Net FrameWork in some way. Back when I installed it on my old laptop I had an error to install .Net FrameWork 2.0.

However I do agree you'd be better of using another language. But .Net seems to be very popular. And the mass majority of people just release simple Keyloggers, RATs, etc.. Something that has been released thousands upon thousands of times. I was hoping some users could start building off of something like this 🤝