how to build quarantine system ?

misael

Member
Joined
Nov 17, 2019
Messages
7
Location
Indonesia
Programming Experience
Beginner
I'm making antivirus but stuck in quarantine feature. im not sure what i do is right way

step that i doing now :

1. create folder quarantine [done]
2. move suspected file into folder quarantine [done]
3. encryption executeable file on quarantine folder. so the suspected file can't be execute again or delete by other antivirus [stuck]
4. restore suspected file to original location if my antivirus false detect [done]

in step 3, i cant find right method.

how to encryption executeable file or is there any another way to handle my problem ?
 
Last edited:
I don't think you're meant to compare the two as they are distinctly different
if any such self-replicating file did recreate itself and and also renamed itself. How will you identify it? I feel that these are things you should know the answers to

that's good to discuss. I really appreciate ur good intentions of sharing information but it's too far from the topic. I just want to focus on the quarantine system for now

And I also feel that you are quite adamant to get us to answer you and help accomplish this ransomware for you. Call it what you want, but any file that gets locked into a vaulted folder or archive is essentially ransomware, especially if your application is the deciding factor on whether the file will ever be released or not.

if i try to get the poin ur quot, u want say, any software can lock the file or restrict access the file are ransomware. I disagree with that coz many apps can lock files but are not detected as ransomware by avast. if i following ur opinion, winrar is a ransomware also, exelock by kakasoft is also ransomware

okay, I think in this section we have different thoughts and opinions

your use of wording is exactly the way script kiddies write. If you really want to be taken seriously, drop the MSN/Skype lingo and write your words as they should be written in full English

I dont know the meaning of "script kiddies write". if you mean newbie, beginner or something like that then its right, that is me. its okay if you say I'm a bad programmer but if someone accused me of making a virus then I'm not comfortable hearing it maybe i should close this thread coz that would make the discuss out of topic
 
but it's too far from the topic.
No it's not. It's exactly beside the topic. If your application is going to lock up files in your vault, then I want to know how your application is going to determine what file is a threat and what analysing will take place because when you're dealing with self replicating files, you will need stronger methods than some shoddy MD5 check. You still haven't told us what these checks consist of, yet you are seem adamant to lock a users files in a vault before considering this step. This raises suspicion. Don't you think?
if i try to get the poin ur quot, u want say, any software can lock the file or restrict access the file are ransomware. I disagree with that coz many apps can lock files but are not detected as ransomware by avast. if i following ur opinion, winrar is a ransomware also, exelock by kakasoft is also ransomware
Don't be trying to manipulate my words, but essentially that is exactly what I am saying. When an application takes a file from one position and shelves it inside some protective storage database/vault, and bleaches the original file from the system. Then that is ransomware because only your application will decide whether that file will be unlocked and released from your storage vault, and only by the will of your application. I am not just talking about just locking a file, but holding it hostage from its user and the rest of the filesystem where it belongs. That is ransomware. And we have no proof that you or another reader are not going to do this. As Skydiver already said, helping someone to build an AV can be also used for malicious purposes :
The same technology that is used for making AVs can also be used to make viruses and ransomware.


if i following ur opinion, winrar is a ransomware also, exelock by kakasoft is also ransomware
Don't be a dumb shit all your life. Reread what I wrote before making silly statements :
Call it what you want, but any file that gets locked into a vaulted folder or archive is essentially ransomware, especially if your application is the deciding factor on whether the file will ever be released or not.
WinRar, 7Zip, and alike are zipping tools and considered white listed applications by various AV companies and they don't violate a users rights to files on the filesystem. What gets zipped can be unzipped by the user and they allow the user full control over the contents being zipped and unzipped. If a user zips an archive with a password, only that user who zipped it will be able to unzip it. These applications do not violate a users right to access their files before or after zipping. Your application could violate those users rights to access files on their system; thus holding them to ransom. As I already explained to you, we do not know the true intentions of your application or those who follow this topic at a later date.

If you want to create a legitimate AV, then go and educate yourself on the subject, because I highly doubt anyone here will be willing to give any further information on this subject. If your application was not malicious, it wouldn't be getting swallowed up for violating safety standards which raises red flags to other AV software(s). I'll park this one here.
 
I'm making antivirus but stuck in quarantine feature. im not sure what i do is right way

step that i doing now :

1. create folder quarantine [done]
2. move suspected file into folder quarantine [done]
3. encryption executeable file on quarantine folder. so the suspected file can't be execute again or delete by other antivirus [stuck]
4. restore suspected file to original location if my antivirus false detect [done]

in step 3, i cant find right method.

how to encryption executeable file or is there any another way to handle my problem ?
Hlo If you want answer message me in instagram
My instagram ID name is ronitshrivastav.5
and Facebook Ronit Shrivastav
 
This forum is based partly on the idea of community learning. Why don't you share your knowledge?

Also consider that the OP has not logged in since 2019. He may not be interested anymore, but those who find this thread in the future maybe.
 

Latest posts

Back
Top Bottom