病毒检测方法

1、静态文件检测
利用文件头部相应属性的Md5值作为特征进行网络数据文件的检测，一般用于网关产品。

2、动态文件检测
将病毒文件运行到虚拟系统中，利用文件的动作行为检测是否为病毒，如杀毒软件。

判断文件或URL是否为恶意的主要开源网站为：virustotal.com，包含41款杀毒软件，功能非常强大，速度非常快1分钟之内完成扫描，virscan.com包含36款杀软但扫描速度慢一般需要5-15分钟。

其它网站：

http://sectools.org/tool/

http://www.malwarebytes.org/products/malwarebytes_pro/

http://www.malwarebytes.org/products/malwarebytes_pro/

http://www.malwaredomains.com/

Antivirus products

• Agnitum (Agnitum)
• AhnLab (V3)
• Antiy Labs (Antiy-AVL)
• Aladdin (eSafe)
• ALWIL (Avast! Antivirus)
• AVG Technologies (AVG)
• Avira (AntiVir)
• BitDefender GmbH (BitDefender)
• ByteHero Information Security Technology Team (ByteHero)
• Cat Computer Services (Quick Heal)
• Commtouch (Command Antivirus)
• ClamAV (ClamAV)
• Comodo (Comodo)
• Doctor Web, Ltd. (DrWeb)
• Emsi Software GmbH (Emsisoft)
• Eset Software (ESET NOD32)
• Fortinet (Fortinet)
• FRISK Software (F-Prot)
• F-Secure (F-Secure)
• G DATA Software (GData)
• Hacksoft (The Hacker)
• Hauri (ViRobot)
• Ikarus Software (Ikarus)
• INCA Internet (nProtect)
• Jiangmin
• K7 Computing (K7AntiVirus)
• Kaspersky Lab (Kaspersky)
• Kingsoft (Kingsoft)
• McAfee (VirusScan)
• Microsoft (Malware Protection)
• Norman (Norman Antivirus)
• Panda Security (Panda Platinum)
• PC Tools (PCTools)
• Rising Antivirus (Rising)
• Sophos (SAV)
• Sunbelt Software (Sunbelt antivirus)
• SUPERAntiSpyware (SUPERAntiSpyware)
• Symantec AntiVirus
• TodalDefense (TotalDefense)
• Trend Micro (TrendMicro, TrendMicro-HouseCall)
• VirusBlokAda (VBA32)

File characterization tools & datasets

• Androguard (Anthony Desnos)
• Cuckoo Sandbox (Claudio Guarnieri)
• ExifTool (Phil Harvey)
• Magic descriptor (Linux)
• NSRL information (NIST's National Software Reference Library)
• PDFiD (Didier Stevens)
• pefile (Ero Carrera)
• PEiD (Jibz)
• Sigcheck (Mark Russinovich)
• ssdeep (Jesse Kornblum)
• TrID (Marco Pontello)

Website/domain scanning engines & datasets

• Alexa (Amazon)
• AlienVault (AlienVault)
• Antiy-AVL (Antiy Labs)
• Avira Checkurl (Avira)
• BitDefender (BitDefender)
• CLEAN MX (CLEAN MX)
• Comodo Site Inspector (Comodo Group)
• C-SIRT (Cyscon SIRT)
• Dr.Web Link Scanner (Dr.Web)
• EXPOSURE: Exposing Malicious Domains (iseclab.org)
• G-Data (G Data)
• Google Safebrowsing (Google)
• hpHosts (Malwarebytes)
• K7AntiVirus (K7 Computing)
• Malc0de Database (Malc0de)
• Malware Domain Blocklist (Malware Domain Blocklist)
• Malware Domain List (DNS-BH Malware Domain List)
• MalwarePatrol (MalwarePatrol)
• Minotaur (NovCon Solutions)
• Netcraft (Netcraft)
• Opera (Opera)
• Palevo Tracker (Abuse.ch)
• ParetoLogic URL Clearing House (ParetoLogic)more info
• Phishtank (OpenDNS)
• SCUMWARE (Scumware.org)
• SecureBrain (SecureBrain)
• Sophos (Sophos)
• SpyEye Tracker (Abuse.ch)
• Sucuri SiteCheck (Sucuri)
• Trend Micro Site Safety Center (Trend Micro)
• urlQuery (urlQuery.net)
• VX Vault (VX Vault)
• Websense ThreatSeeker (Websense)
• Webutation (Webutation)
• Wepawet (iseclab.org)
• WOT (Web Of Trust)
• Yandex Safebrowsing (Yandex)
• Zeus Tracker (Abuse.ch)
• Zvelo (Zvelo)

File characterization tools & datasets

• Androguard (Anthony Desnos)
• Cuckoo Sandbox (Claudio Guarnieri)
• ExifTool (Phil Harvey)
• Magic descriptor (Linux)
• NSRL information (NIST's National Software Reference Library)
• PDFiD (Didier Stevens)
• pefile (Ero Carrera)
• PEiD (Jibz)
• Sigcheck (Mark Russinovich)
• ssdeep (Jesse Kornblum)
• TrID (Marco Pontello)