3

I was a little surprised that https://stackoverflow.com/questions/7873456/how-to-write-a-virus was closed so quickly.

It was marked as "Not Constructive," but I don't understand why: I made it very clear that I am not trying to create a virus, but to rather simply look like one, just to learn more about their detection. I'm also having trouble understanding why they would involve "arguments" or "polling," as it seems like there should a way to do this without flaming arguments.

Is there anything I could improve in it to make it to make it more appealing, and hopefully re-open it, or is it somehow fundamentally a broken question? (If so, why?)

Improve this question

3 Answers 3

Reset to default
7

In my opinion it is much too broad to qualify for Stack Overflow. You're basically asking: "How do I trigger an anti-virus alert?".

What could trigger an alarm for a virus scanner?

Well, a great number of things. That's probably what got you the "not constructive" close reason, there is no way to write a comprehensive answer to that. Any attempt at doing so would be obsolete a few hours after it is written.

There are thousands of behaviors that could trigger anti-virus systems. Just look at the size of the databases these products use. (That size is probably more due to signature matching, but heuristics used are also quite wide-ranging.)

If you have a specific set of warnings/alerts you want to trigger, study them carefully and try to trigger them. If you get stuck on coding issues implementing that, Stack Overflow can probably help you out (if you state your goal very clearly - if it is interpreted as being an attempt to write malware, I wouldn't bet on it staying visible for any length of time).

Do note that you are treading dangerous ground here. Analyzing anti-virus software behavior and probing their heuristics is partly how ill-intended people go about building their software.

And "white hat" viruses are controversial. Make sure your "creations" don't escape your lab.

Improve this answer
5
  • This. It is too broad a question for SO.
    – user1228
    Oct 24, 2011 at 14:27
  • +1 Given my obvious inclination to disagree, it's great that I'm having trouble doing that -- for the most part anyway. :) Thanks for the answer, I'll see if I can improve it. But one question: Since I'm looking for a single example of something that could trigger an alarm, is that still considered too broad? The answer would be clear -- anything that does so would get accepted, right?
    – Downvoter
    Oct 24, 2011 at 15:09
  • @Downvoter: in my opinion, you still risk the "not constructive" close there, because hundreds of different answers would be correct. It's essentially a poll/list-of-stuff type question. And I'm not clear on your goal exactly, but wouldn't focusing on something specifically you want to trigger, and doing a bit a research on that be more beneficial to you? Browse the security mailing list archives/forums/sites, there is tons of info from reliable sources out there.
    – Mat
    Oct 24, 2011 at 15:19
  • @Mat: Ah, I see. Do you happen to have a link I could look at? I'm not sure where to start.
    – Downvoter
    Oct 24, 2011 at 15:20
  • @Downvoter: don't keep asking yourself where you're going to start and actually start. Use your favorite search engine. You know what you're after, look for it.
    – Mat
    Oct 24, 2011 at 16:50
4

I would like to program a file that, when scanned on VirusTotal, gives a positive result for most of them.

It seems you are asking how to write a program that a virus scanner would report infected by most of the viruses it is able to detect.
As it is, the question doesn't report what the actual problem you are trying to solve is, and it seems there isn't an actual problem to be resolved. The FAQ reports the following sentence:

You should only ask practical, answerable questions based on actual problems that you face. Chatty, open-ended questions diminish the usefulness of our site and push other questions off the front page.

If the purpose is creating a test file to verify if VirusTotal gives false positives, then you can use the test file that is universally used for that purpose: the EICAR test file. If the purpose is testing an antivirus program you created, then the EICAR test file is still the answer.

Improve this answer
2
  • Well, my goal was to learn something here. The trouble is, EICAR doesn't teach me anything whatsoever -- it makes no sense as to why it should trigger an antivirus, and the fact that it "just does" is just a mystery. I was hoping for something I could reason about... hope that makes sense?
    – Downvoter
    Oct 24, 2011 at 15:15
  • You should ask a question because you have a problem to resolve, not because you want to learn something. Stack Overflow, as other SE sites, is not a forum where you pass time reasoning about programming topics.
    – apaderno
    Oct 24, 2011 at 21:02
3

Problems I see with your question:

  1. The title is downright begging for the question to get closed. How to write a virus? does not sound quite as well as What events cause a virus scanner alarm? or something like that.

  2. It is not clear why you need to know that. Is it plain curiosity? Are you trying to create a malware scanner? Are you trying to create malware?

    How to write a virus?

    Well, that's not quite my goal, but it's close.

    certainly sounds more like the latter than the other two...

    Also, plain curiosity would mean that your question is not based on actual problems that you face, which is a requirement for any question asked on Stackoverflow.

  3. You should be more specific about what type of malware detection you are interested in.

    Do I enumerate all the files on the system and call DeleteFile?

    is certainly undesired behavior, but it is not what a virus would do. A virus is a program that attempts to replicate itself and spread from one computer to another.

    Also, a malware scanner can detect malware in a certain number of ways. It looks like you arre interested in real-time behavior guards rather than signature detection (which is why the EICAR file everyone is recommending will not be of any use to you), but you would have to clarify that.

That being said, I would love to see your question reopened.

Improve this answer
2
  • Your reasons 1 and 3 are great, but I'm having trouble with #2 -- does "learning" count as a reason, or does there physically need to be a manager (or teacher) pressing me to finish a project before it's a "real" problem and I can ask it on SO?
    – Downvoter
    Oct 24, 2011 at 15:14
  • Everybody interprets the FAQ differently. Personally, I don't think that we should be overly picky about this (after all, we don't know the real motivation behind 90% of the questions), but that's just me. The important thing is that you make clear you ask the question from an anti-malware perspective and that you narrow it down to the specific functionality you care about. Constructive questions that are overly broad still get closed...
    – Dennis
    Oct 24, 2011 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .