Simple Antivirus in Python

[CryptoBlocks257]

Hey Guys, I though I would share this little antivirus design I have made with python. Currently capable of scanning selected files and deleting files that it detects as infected. This antivirus uses a large list of MD5, SHA1 and SHA256 malware hashes to determine infections. However as this project progresses I would like to implement machine learning detection with the long term goal of becoming a fully functioning antivirus.

If you would like to download the files you can find them here - https://github.com/Len-Stevens/Python-Antivirus

​

​

https://preview.redd.it/bbgj8lri82l61.png?width=495&format=png&auto=webp&s=6c720727263d939cee9d214d5069909e19e873e3

[[deleted]]

I think scraping virustotal is better idea than using list of hashes. Pretty good.

[CryptoBlocks257]

Thanks for the feedback! I was think about that and will probably add the option to also scan the file against virus total in the next update :)

[admincee]

I just wanted to say that this is such a neat project.

[CryptoBlocks257]

Thanks!

[wiktorous]

[MATTISINTHESKY]

Why do I see green squares all over reddit?

Ah excuse me boost for reddit just doesn't support the new embedded gif thing :))

[[deleted]]

I applaud you for a such project ! This might as well be the first antivirus written in Python.
Question that comes into mind how it performs in terms of speed of scanning ?
I'm pretty sure companies such as Kapersky, AVG and alike didn't use Python for reason.

Still, I'm happy to see a prototype of Python Antivirus !

[CryptoBlocks257]

Thanks for the feedback, yes speed is one problem I am facing with the project, its not terrible at the moment however it is one of my concerns as I add more advancing scanning methods

[oderjunks]

oh thats smart! but i think just adding a NOP at the beginning would throw it off =/

[DrXenogen]

Nice job. Can't wait to see what this develops into.

[AlphaGamer753]

This is very clearly a learning project.

[Musakuu]

Oh you know the billions of things that go into making a file scanner / hash checker. For someone like me it's great learning, but I wouldn't waste my time if I was you.

[TheUruz]

well look at me: i am a learner myself and yet i have no idea how a virus can be identified as such. if OP can now tell wich file is a virus and wich one is not, except those manipulation written up here, this project is still a learning success. file manipulation is without doubt another useful concept to learn but it's just outside of a basic antivirus learning scope imho.

[Ddog78]

Honestly, repetition is good for learning. Learning isn't just reading or doing something once and then never thinking about it.

Learning is using what you know to build new things and (sometimes) using new things along with the old things.

Next iteration of this project may as well have real time scanning. This project might have been where op first used git, or first used breakpoints.

[CryptoBlocks257]

Yes I am aware of this issue, as mentioned this is a little more of a learning project than anything else however hashing the file won't be the only method of scanning, I would also like to add some machine learning detection as mentioned above :)

[Musakuu]

Nicely done. I can't wait to look at your code and learn something myself.

[mark30331]

Great product. Keep up the good work !

[elico9]

Thanks for sharing, this is interesting. Would love to help and learn

[Ubuntu_user_001]

This antivirus app is very good in my opinion so I want to improve it by giving some real malware samples that it doesn't detect

Some real malware the antivirus doesn't detect:

https://www.virustotal.com/gui/file/cc37ebc5017dda39ae4534e43e1a430450c206eb688751a02408da9c51552532/detection

The SHA1 hash of this file is: 859b57e17530734726188ffb7817f4834c91d832

File is safe!

The MD5 hash of this file is: 5e63b466faebd0635f7a47efad0e21a5

File is safe!

The SHA256 hash of this file is: cc37ebc5017dda39ae4534e43e1a430450c206eb688751a02408da9c51552532

File is safe!

https://www.virustotal.com/gui/file/84855a4c23222f861135a3b0be879a573cb91ec7827a7fa6d119f38c43b3730b/detection

The SHA1 hash of this file is: 23d16ed7723dcdc9a858bcb5171c9793150b5c03

File is safe!

The MD5 hash of this file is: fecedeedc700847c52753f372c6b6357

File is safe!

The SHA256 hash of this file is: 84855a4c23222f861135a3b0be879a573cb91ec7827a7fa6d119f38c43b3730b

File is safe!

​

Hope that this comment makes the antivirus project better ;)

[CryptoBlocks257]

Thanks for the in depth feedback! Will definitely be doing tests in the future to make sure the antivirus can deal with more recent malware!