Mark Buffalo has already provided an good answer on things to consider. However, I'd like to expand on his answer with few solutions, ofcourse it's extremely broad question so by all means this isn't remotely close to an "best" solution. It's just things to consider.
I'll be making many assumptions based on this question and they will be:
- The operating system your using is Windows
- Your system architecture is x86 or x64
- You've got an good understanding of Windows internals.
"Viruses" can merge with existing executables
There are soo many ways on how to do bind executables.
Let's say we have "notepad.exe" as the legit program and "virus.exe" which is the malware. Virus.exe could write itself into the RAT (Resource Address Table) of notepad.exe and replace the OEP (Original Entry Point) with it's custom loader which will execute the malware code then run notepad.exe.
You can defeat this by reading the RAT and doing an .text PE signature.
Code Project - .Text Checksum
Keep in mind this can be defeated by metamorphic and polymorphism which the code is changed on each execution resulting in unique hash for the .text but is much harder to perform. Read through some of z0mbie's code on how it's executed and so on.
z0mbie - Sample malware code etc
You could only defeat this by extreme measures which I'm unaware of been automated, is things which execute in an squence which are malware related. For example, let's pretend
DeleteFileW( L"C:\SomeImportantFile.exe" ); so, let's say the code is as follows:
MOV EAX, 0x12345
Now in terms of efficency it will be slow but you could signature the PUSH EAX, CALL as it will always be same bytes and in your code read what values is held at 0x12345 as this memory address will likely be different.
Changing their source, or even recompiling the virus will defeat you
From the above you'll able to get around this.
To cover other points which have not been talked about:
- Dll injection
- Code injection
- SSDT hooking
- Kernel patching
I do believe this question is more of an question for https://reverseengineering.stackexchange.com/ However, I believe it's too indepth to answer.