Thread: private Virustotal

I would like to build for myself and maybe for some other dudes similar service like Virustotal ofc w/o sending anything. VMs will not be directly connected to net. And each few day I would like to revert snapshots to update virus signatures.

Right now I have many virtual machines with many AV's but scanning my exe manualy is monkey job.

I would like to build interface for it. Where you can just send exe and wait for nice results.
My problem is that I have no idea how to communicate with such many AVS and especially how to grab their results?


I know there are some private services but I'm not going to pay a cent for it. Rather build my own and learn something new.

Do you have any suggestion how such thing could be accomplished? (Especially grabbing AV's results..) Do most AV support command line interface?

Thanks

Originally Posted by d1vers1ty

I would like to build for myself and maybe for some other dudes similar service like Virustotal ofc w/o sending anything. VMs will not be directly connected to net. And each few day I would like to revert snapshots to update virus signatures.

Right now I have many virtual machines with many AV's but scanning my exe manualy is monkey job.

I would like to build interface for it. Where you can just send exe and wait for nice results.
My problem is that I have no idea how to communicate with such many AVS and especially how to grab their results?


I know there are some private services but I'm not going to pay a cent for it. Rather build my own and learn something new.

Do you have any suggestion how such thing could be accomplished? (Especially grabbing AV's results..) Do most AV support command line interface?

Thanks

Most antivirus have a command line feature. That's where you want to start
Getting the output from the command line should be simple for you
If you finish it it should be for OpenSC private use. Specific users can only use it. That's my opinion. Give OpenSC something different you know?

OK.

I will try to make .NET client which will be inserted into each VM.
That client will communicate with central server.

Using some nice fw its possible to filter all traffic into internet except client APP.
This way is possible to host many virtual machines by anyone who is interested to support.

I for sure don't have HW resources to host all 43+ AVS on different systems at the same time..

I'm starting to search for info how to do this w/o much effort

Originally Posted by d1vers1ty

OK.

I will try to make .NET client which will be inserted into each VM.
That client will communicate with central server.

Using some nice fw its possible to filter all traffic into internet except client APP.
This way is possible to host many virtual machines by anyone who is interested to support.

I for sure don't have HW resources to host all 43+ AVS on different systems at the same time..

I'm starting to search for info how to do this w/o much effort

You're making this way too complicated, install the AV, get the cmd line for scanning a file and get the output. its simple. :/

Yes you are right, sorry its simpler than i thought.
I didnt realize its possible to have many avs at the same system. Like hh.multiscan

will try to make something

Have a look at the HH multiscan thing, basically a compiled list of console avs which uses a program to run them all (on 1 pc).

OK i played little bit with ASP.NET and have working version for nod32.. Now I just need to collect rest of AVs and make some parsing..

Should be ready for testing in few days

Now I have nod32+Avast+AVG ...

Trying to install Kaspersky Anti-Virus 2012 --- Installation cannot proceed until i remove avast+eset .... :'(

I have an AV scanner script made by a very good coder. I'll sell it to you if you want it, it comes with documentation on how to make it grab the AV scan output

no i really dont want it, lol