BleepingComputer.com: Make an anti-virus via notepad

I'm sorry if this is the wrong board. This is the closest board I could find to my question.

I want to make a .bat file that deletes known viruses and worms in the system32 file. I'm about 100 lines into it but when I save it onto my desktop and try to run it first thing is that my AVG is saying it's a worm and wants me to add it to my vault, so how do I stop that. Second is it's saying I do not have permission to acess the file,path or device. How do I get acess to it.. I'm on my only account and it's an admin with full rights. Thanks!

This post has been edited by Tafoya: 25 October 2010 - 04:38 AM

I'm afraid that would be like trying to build a battle tank out of cardboard.

Quote

Just so you are aware, there is more to malware removal than just deleting some files. There are also often registry keys, etc that go along with it. Still, I suppose it is possible, just not a very efficient way to go about it.

I have no idea what operating system you are running, but the Windows folder is a protected folder. Any read-writes that take place have to be done by processes with administrative rights. Just because you have admin rights does not mean that the file you created does. A couple things to think about. What happens if there is a problem with your file and you do actually get it to run? You could accidentally brick your system. Another thing is messing around with permissions is a god way to open your system up in ways you can never imagine. I say that because if you are trying to go about removing malware with .bat files, then you don't exactly understand the environment in which you are trying to work.

If you are going to go about doing this, set up a virtual machine on your system and work with that. If you wreck that, you can easily restore an image. Not so much if you brick your entire computer.

Your anti-virus is behaving exactly as it should. It is letting you know that an unauthorized file is trying to do file manipulation in a place where it has no business doing so. I am not sure if AVG has a setting to ignore certain fies or not.

That strategy is effective only if you are sure that a computer is infected by a certain malware program and you know what changes that particular malware program makes to files, folders, registry etc.

groovicus, on 25 October 2010 - 06:40 AM, said:

Sorry, I did not explain in full. It is going to point to all known places where the malware or virus is known to hide i.e system32 or yes the Reg. I already have an image of my OS for this computer, it's Win7 32bit.

Romeo29- It's going to be a .bat turned into an exe, it will run and if the files the .bat are looking for are not their it will do nothing, I am creating this just so I am able to scan computer and remove most if not all of the malware/ virus with it. I've already tested this on my computer and my laptop


So a new question, if anyone can answer it. Does anyone know how to add a choice option for the user using the .bat such as
choice 1=start choice 2=exit and make them each do what they say they're supposed to.

This post has been edited by Tafoya: 25 October 2010 - 06:46 PM

Its been a long time since I have done this but I believe it was if errorlevel
If you google it you will find lots on it

Just out of curiousity, will you post the code here or give me a link where it was found? I think it would be an interesting thing to look at, and perhaps I will diddle around with it a bit.

Tafoya, on 25 October 2010 - 12:10 AM, said:

I think you should forget this idea.
Batch file execution in Windows depends on cmd.exe, it could not remove all the malware which you want to delete.

How does the batch file know the file is even infected?

ident, on 08 January 2012 - 09:34 AM, said:

Some people use the path & filename, file size to know some file is infected.
This way is not based on signature which antivirus programs base on and could provide false detections & removals.

Minh Triet Pham Tran, on 08 January 2012 - 12:44 PM, said:

That didn't answer my question. I already knew the answer. This route could lead to issues and is not an Anti virus.

Tafoya, on 25 October 2010 - 12:10 AM, said:

You have to elevate.

Why don't you download combofix.exe winrar or uniextract will separate the components out for you and once you understand all that is involved you might have an idea of the complexity of the situation that you are confronting. a Batch file is useless against rootkits, Don't forget that you will have to be active in the anti-virus community and keep at it daily or your 'batch file.exe' will quickly become out of date.