6

I suppose that every one used a service such as virustotal.com, anubis.iseclab.org, or any other service that could provide the same objective to scan same files.

So my question is how can I make the same thing at home, for my personal use since you can't install more than one anti-virus on your os?

  • 1
    You want to create an anti-virus server yourself? Why not go with the existing ones? – S.L. Barth - Reinstate Monica May 4 '15 at 10:57
  • I receive a hug number of files, and I would like to make a kind of service that could autocratically scan it all at once, and I would like to know how it works, and this is the main idea :) – Barttttt May 4 '15 at 11:01
  • 5
    Given the amount of technical know-how involved in building malware detection software, and in setting up robust virology environments, I would be tempted to close the question as too broad. If you want to do as good as the professional services out there, what you need is to read books and take courses on the topic, not just install some software. My uni's malware lecturers recommend nostarch.com/malware as an introduction. – Steve Dodier-Lazaro May 4 '15 at 12:03
  • 1
    If you can configure your consumer-level AV to disable automatic real time scanning and interact it with the command line, you can build your own Virustotal. Have an agent that calls the CLI antivirus on the potential malware and collect the results. Put that in a VM which gets reset after each scan. – user42178 May 4 '15 at 12:34
  • 1
    @SteveJessop definitely a mistake (that's so nice of you to give the DDoS botnet operator your shiny malware-analysis server and its 10Gb/s connection) . The VM image should be automatically built with the latest updates on each run, and destroyed afterwards, without any outside communication possible (other than with the agent to collect the results - which should preferably happen over a virtual serial port rather than a virtual network interface) – user42178 May 4 '15 at 16:02
9

This can be done using techniques like:

  • Docker
  • virtual Machines
  • Jails
  • Clusters (out of scope for home use)

The trick here is to NOT use a single user environment like Windows. but use a environment where you could safely test any file without risk of infection. So you need a READ-ONLY Environment (full OS, not just the location being tested) which makes using a *NIX ideal.

  • 1
    Your answer is very superficial: use Docker or Jails to do what exactly? And why would a single jailed process opening an allegedly malicious file be more likely to trigger an exploit than a full-blown virtualised system or throw-away computer, especially given that the attack surface within a jail and in a typical server/desktop environment are very different? – Steve Dodier-Lazaro May 4 '15 at 22:48
  • This is a list of techniques one could employ to make such a system. and yes it is not specific as to how to employ them. An answer like that would be out of scope for Security.se – LvB May 5 '15 at 15:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.