How to make an Antivirus Program in JAVA

Today we will make an antivirus program using Java Programming Language. This code can be done in any programming language. The below written code is how an ANTIVIRUS works in actual or you can say its the algorithm (written in JAVA) to make people understand the basics of ANTIVIRUS internal searching mechanism.

The main point behind searching any virus is identifying the code structure or defining characteristics or simply definitions of any virus file. Suppose, we’ve found this following virus in computer :

Now we’ll see the Binary code of this file.Simply open this file in your favorite text editor. I advise you to use Notepad++ or TextPad for this purpose. Upon opening the file, you’ll see all unknown characters in file. What you have to do is just concentrate on characters which are identifiable (consider the image below).


Now create a virus definition using the identifiable characters along with there line numbers and save them in a text file, say defination.txt Copy the below source code in file named AntivirusAlgoInJava.java. Place the AntivirusAlgoInJava.java,defination.txt and your virus file in the same folder and then compile and run the java code from command line.

/* ***********

The below written code is how an ANTIVIRUS works in actual or you can say its the algorithm(written in JAVA)
to make you people understand the basics of ANTIVIRUS internal searching mechanism.

Note:-Its not a full fledged ANTIVIRUS, its only the internal searching mechanism of any ANTIVIRUS.

*********** */
import java.io.BufferedReader;
import java.io.FileReader;
import java.util.HashMap;
import java.util.Set;
import javax.swing.*;

class AntivirusAlgoInJava {
    int count = 0;
    int size = 0;
    int occur = 0;
    HashMap hashMap = new HashMap();
    void readPattern(String filename) throws Exception {
        try
        {
            FileReader in = new FileReader(filename);
            BufferedReader br = new BufferedReader(in);
            String line;
            int i = 0;
            while ((line = br.readLine()) != null) {
                hashMap.put(line.substring(0, line.indexOf("/")), line.substring(line.indexOf("/") + 1, line.length()));
                ++i;
            }
            size = i;
            br.close();
        }
        catch(Exception e)
        {
            //System.out.println("Hello"+e);
        }
    }
    void searchVirus(String file) throws Exception {
        FileReader in = new FileReader(file);
        BufferedReader br = new BufferedReader(in);
        String line;
        while ((line = br.readLine()) != null) {
            Set keys = hashMap.keySet();
            count++;
            boolean containsKey = keys.contains(String.valueOf(count));
            if (containsKey) {
                String virus = hashMap.get(String.valueOf(count));
                if (line.indexOf(virus) > -1) {
                    occur++;
                }
            }
        }
        br.close();
        if (size == occur) {
            JOptionPane.showMessageDialog(null, "Error", "Virus Detected ", JOptionPane.ERROR_MESSAGE);
        }
        else{
            JOptionPane.showMessageDialog(null, "Clean File", "No Virus Found ", JOptionPane.INFORMATION_MESSAGE);
        }
    }
    public static void main(String []nix) {
        try {
            for (javax.swing.UIManager.LookAndFeelInfo info : javax.swing.UIManager.getInstalledLookAndFeels()) {

                if ("Nimbus".equals(info.getName())) {

                    UIManager.setLookAndFeel(info.getClassName());
                    break;
                }
            }
            } catch (Exception ex) {
        }
        try {
            AntivirusAlgoInJava fr = new AntivirusAlgoInJava();
            fr.readPattern("definitions.txt");
            fr.searchVirus("virus.exe");
            } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

In the above images you can see at line no 4,9,13,16,21 encircled in red that characters V,I,R,U,S are present. So now our virus definitions have been satisfied and we can say that it’s a VIRUS. When the code run you should a similar response as shown in the image below.



You can download live virus file for analysis from here.