[5chn4pp]

I have an idea how to make a cmd virus scanner, but i need help with this.

So, i have a program that can create a md5 hash of a file. here is the line:

Code

fciv -md5 -add ReadMe.txt>output.txt

As you can see, it makes a output.txt file of the md5 of another .txt file.

Here is how the output looks:



And here is all the files:



My question is, how can i scan all the files on a computer and make them in a single output.txt file?

After we solve that, how can we then scan the output for bad md5 hashes? (all the bad hashes are in the database.txt file)

If you want a download of the files, i can give you them.

[.waste]

Search for all drives and scan the the files in each drive for their MD5 hashes, checking them against your database.

[5chn4pp]

Search for all drives and scan the the files in each drive for their MD5 hashes, checking them against your database.

drivers are only like 30% of all viruses, and im asking how to actually do the code.

[.waste]

drivers are only like 30% of all viruses, and im asking how to actually do the code.

Reread what I posted, I did not say drivers. You must find all the drive letters. As for what to do when you get the locations, do a recursive search, if its a folder: search the folder, otherwise get the MD5 of the file and check against the database.

If you give me a download to the files I'll see what I can come up with.

[5chn4pp]

Reread what I posted, I did not say drivers. You must find all the drive letters. As for what to do when you get the locations, do a recursive search, if its a folder: search the folder, otherwise get the MD5 of the file and check against the database.

If you give me a download to the files I'll see what I can come up with.

well, if i try to scan for example the C: drive, it will not go into the directory and scan there

https://mega.co.nz/#!nQNwSJDD!D0dc5pUGnv...o5L75Jr03g

[.waste]

well, if i try to scan for example the C: drive, it will not go into the directory and scan there

https://mega.co.nz/#!nQNwSJDD!D0dc5pUGnv...o5L75Jr03g

Taking a look at fciv, it seems it has a recursive scan feature.
Check out fciv.exe c:\ -r

[5chn4pp]

Taking a look at fciv, it seems it has a recursive scan feature.
Check out fciv.exe c:\ -r

I cant believe that worked, well, problem 1 is kinda solved, because it crashes everytime i try to scan my C: drive

EDIT: its taking up all the write speed on the hdd, and thats why its crashing

[.waste]

I cant believe that worked, well, problem 1 is kinda solved, because it crashes everytime i try to scan my C: drive

EDIT: its taking up all the write speed on the hdd, and thats why its crashing

Working for me, no crashes. Read up on some of the switches and uses of fciv here to get an idea of what you can do with it.

[5chn4pp]

Working for me, no crashes. Read up on some of the switches and uses of fciv here to get an idea of what you can do with it.

Code

@echo off
fciv -md5 -add C: -r -type *.exe>outputexe.txt
fciv -md5 -add C: -r -type *.dll>outputdll.txt

I have done this, it will now only list .exe and .dll and now its not crashing anymore. problem 1 solved.

---

Im also thinking of a "Whitelist" so every normal windows file with a normal md5 hash is not listed, i have no idea how to do that tho.

---

UPDATE:

I have added bat files to be listed, and improved the code:

Code

fciv -md5 -add C: -r -type *.exe -type *.dll -type *.bat>scanned files.txt

New download: posting soon

[Hackoo]

Code

@echo off
fciv -md5 -add C: -r -type *.exe>outputexe.txt
fciv -md5 -add C: -r -type *.dll>outputdll.txt

I have done this, it will now only list .exe and .dll and now its not crashing anymore. problem 1 solved.

---

Im also thinking of a "Whitelist" so every normal windows file with a normal md5 hash is not listed, i have no idea how to do that tho.

---

UPDATE:

I have added bat files to be listed, and improved the code:

Code

fciv -md5 -add C: -r -type *.exe -type *.dll -type *.bat>scanned files.txt

New download: posting soon

First, i want to thank you for this nice project 👍
You forgot to add also VBS and VBE files 😅
If i have time, i will join your project
To compare MD5 hach, you need to install this MD5 Component :
The MD5 component uses the industry-standard MD5 checksum algorithm to get a fingerprint of a file. If you are storing files in a database, this component is a must. To avoid storing duplicate files in the database, store the MD5 checksum along with the file in the database. Every time you save a file, take an MD5 of the file and compare it to the list of MD5s stored in the database to see if this file is already stored. This component can be used in environments that support COM such as Active Server Pages, Windows Scripting Host, Visual Basic, etc.
And this an example that show you how to use it with a vbscript : Calculate MD5 Checksums.vbs

[5chn4pp]

First, i want to thank you for this nice project 👍
You forgot to add also VBS and VBE files 😅
If i have time, i will join your project
To compare MD5 hach, you need to install this MD5 Component
And this an example that show you how to use it with a vbscript : Calculate MD5 Checksums.vbs

Thanks for the kind words and links, you can join if you want.

Here is a updated link of what i have done so far
https://mega.co.nz/#!VpVGSAyI!oJsVGXtzDg...w34iY0jP48

---

I will give a update on this.

I have a database.txt file with strings of md5 hashes in it. i need to compare that to the scannedfiles.txt then i need it to create a new .txt with all the hashes in the database that were found in the scannedfiles.txt. then it can scan for the md5 hashes we want. after that we need to go to the scannedfiles.txt and get the dir of were the file is so we can create a .bat that will delete the infected file.

Then we just keep updating the database with new infected md5 hashes(also works with sha1 hashes) and then its a anti virus!

Im not sure how to do this, and i dont know .vbs.

---

Updated the database, I have now found a way for it to detect many files, i will not say it yet.

Added a name, This anti-virus is called Flarus.

Added a interface and a special debug mode, right now its a normal mode but it will be used for finding errors.

Updated files can be found here:
https://mega.co.nz/#!45E03CKD!XxA5OGkA9v...ao7X3lYIuw

Also, this is maybe the smallest anti virus i have ever seen, 69 kb lol. Its also the first open source (If you dont count clam-av) anti virus.

[Advertisement]

Is this not whatever language that fciv.exe is programmed in?

[5chn4pp]

Is this not whatever language that fciv.exe is programmed in?

Its coded in c++, however there is no cmd command for creating a md5 hash, so everything else can be batch.

[Advertisement]

Its coded in c++, however there is no cmd command for creating a md5 hash, so everything else can be batch.

Oh well, what exactly would you need help with for this project?

[5chn4pp]

Oh well, what exactly would you need help with for this project?

I have a database.txt, with all the bad md5 hashes, i need to compare that database to the scannedfiles.txt that program outputs.

If it finds any matches i need it to create another .txt file with all the matches and then i need it to delete the found files.

It seems like a really cool thing, i have always wanted to see a anti virus in cmd 👍

I have a way to update the database often, so it will actually be able to detect files.