want to create a program that can check a file and give output about file is in infected or not,also need to know what kind of infection that file have (ex : Trojan, worms, etc )
Is there a way to create such analyzer using java or python without using an API ?
I want to clarify one thing before answering you question, malware is short term for (malicious software) which includes Trojans, Viruses, Worms, etc...
In response to your question, malware analysis is large subject. It is very hard to do such a program, you need to be a malware analyst to understand how different malware work, how to analyze them and understand their malicious behavior.
Your program should be able to identify if the file is packed, if so, it should unpack it with the right tools, recognize any malicious behavior and many other things to consider.
If you are determined to do the program, I advise you to read Practical Malware Analysis book, understand how malware analysis works, then you can start building your program with a solid understanding of how your program is supposed to work and what it should do.
Hope this helps :)
This question might be better suited for Stack Overflow, however, if I wanted to go about this:
- I would start with a fresh install of an OS and get a md5 & sha256 hash of every file on the hard drive so as to compare known good files against potentially harmful files. A scan would also need to be triggered when new Media is connected (eg CD or Thumbdrive).
- I would look up the OS's API for events in which files are accessed and attempt to scan each of these files as they are loaded into memory and/or created/modified.
- I would look up the OS's API for events in which network addresses are accessed.
After having written a service to preform all 3 of the above steps, I would use results to create a white list of known good files, known bad files, and user modified files which could go either way. This information from a single computer would not be all that useful however ... it would be much better to get these same statistics from a larger user-base to get a more accurate view of good vs bad.
Now, given all that I have listed above ... I would not infact write my own anti-virus ... for the same reason I would not write my own crypto. These things are better left to professionals who get paid to reverse engineer viruses and malware on a daily basis.
If you really want to learn more however, it might be easier done by looking through the code of an OpenSource project like ClamAV