   [.net] Own an antivirus system in C#
  Hello!Now I'm going to write own antivirus system with heuristic analysis. Main part is quite simple: antivirus provides access to virtual files for running application (maybe virus), which works with these files as if they are real. After this antivirus notify what running application attempted to do. I have BoxedApp SDK ( http://boxedapp.com/ ) for emulation of a file system and registry. But antivirus may be more effective and flexible if there are additional tools for recognition of viruses. Maybe there are some ideas (except simple compare of known viruses’ code parts)? Thank you!
  Good luck. Using the virtual app to try out programs before they run for every single thing on the system is going to be a large performance hit, and even identifying what is legitimate vs virus behavior is hard. And that is on top of doing good heuristics, which is difficult in its own right.   ;  In order to implement high-performance file hooking and monitoring, antivirus systems commonly use several low-level functions of the operating system (including, prior to Vista, direct physical disk access).It is difficult to interact with such low-level functions in .net (the reference runtime platform of C#) because .net is a virtual layer on top of the core OS services and there's no guarantee when the runtime can be loaded - native viruses could well be wreaking havoc on the system before that.That, and writing an effective antivirus for common desktop platforms (such as Windows) is very difficult to begin with, as Telastyn explained.   