Open Source C Anti-Malware Software

Announcing The New Robolinux Series 14 Mate LTS - 2034 Robolinux is very pleased to announce a completely new 14.1 Mate privacy centered 1inux operating system you can download freely while also offering our users an optional 14+ advanced upgrade which comes with our Untracker and FAAST Boot along with one click popular privacy software installers like Tor and I2p, Wireshark and Bleachbit plus many more for a fair and reasonable price. Robolinux14.1-Mate is ideal for beginners and advanced users. We are proud that it comes with Enoch AI which is TOTALLY 100% PRIVATE, FREE, HONEST & UNCENSORED built into Robolinux Cinnamon 14.1 The Robolinux 14.1 version with rock solid Long Term Support through 2034! requires users to set secure boot in their BIOS. It is currently available in the Cinnamon desktop flavor. we will release series 14 Xfce version in the next two months.For more information please see Readme file. Warmest regards John Martinson Robolinux.org

Clam sentinel is a program that detects file system changes and automatically scans the files added or modified using ClamWin. Require the installation of ClamWin. For Microsoft Windows 98/98SE/Me/2000/XP/Vista, Windows 7 and Windows 8.1.

YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determines its logic. YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension. YARA-CI may be a useful addition to your toolbelt. This is GitHub application that provides continuous testing for your rules, helping you to identify common mistakes and false positives. If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks.

readpe (formerly known as pev) is a multiplatform toolkit to work with PE (Portable Executable) binaries. Its main goal is to provide feature-rich tools for properly analyze binaries with a strong focus on suspicious ones.

Common network dump analyzer tool to extract application data and pretty show. It reassembles and shows HTTP/SMTP/POP3/IMAP etc files. Please donate if you want this to be a candy.

Geo Firewall performs blocking of network traffic based on geography (geo IP), allows to add custom subnets, allows exceptions on ports for incoming traffic for specific geography, keeps visual and persistent logs, shows statistics, automatically updates geographical database.

Anoubis is a Security Suite which implements a secured environment for applications. The core of the suite is an Application Firewall alongside with a Sandbox. Mechanisms to assure the authenticity of files, directories and applications are provided.

Clam AntiVirus Client Library provides a simple API to the ClamAV daemon. ClamAVC does not require ClamAV to be installed. ClamAVC communicates with clamd using clamd's documented protocol using either TCP or a local Unix domain socket.

Edit the Windows Registry from a Live CD to Remove Malware and fix problems that keeps your system from booting.

This project is intended for generating a series of patches for the current version of QEMU to counter anti-detection and anti-debugging technics.

A packet dissector driven by machine learning algorithms. You train it to recognize specific types of packets by showing it examples and counterexamples of some packet type, and it will figure out which bits in the packet define it as the type you seek.

A hardware supported hypervisor originally built for malware analysis. Features: Linux VM introspection, minimal detectability, small (~150KB), simple, and well documented. Can be used for other purposes. Support for Intel-VT & Windows coming soon.

tpe-lkm is a Linux kernel module implementing Trusted Path Execution, a security feature that denies users from executing programs that are not owned by root, or are writable. This closes the door on a whole category of exploits where a malicious user tries to execute his or her own code to hack the system. Since the module doesn't use any kind of ACLs, it works out of the box with no configuration. It isn't complicated to test or deploy to current production systems. The module also has a few other grsecurity-inspired features implemented as "extras".

VirusTrap is an open source framework for penetration testers, network auditors, system administrators who need to analyze unknown binaries during their work. The scanner was made to help computer users identifying malicious files by scanning them with 25 antivirus engines.

Clamav-redirector is plug-in for Squid that uses the Google Safe Browsing database and, optionally, ClamAV to scan websites. It prevents you from accessing websites that contain malware such as viruses and trojans.

Is your server running slowly? Clamav-sniffer could help - it scans for malware such as phishes and viruses and configures your firewall to block the cracker.

mod_dnsblacklist is a Lighttpd module that use DNSBL in order to block spam relay via web forms, preventing URL injection, block http DDoS attacks from bots and generally protecting your web service denying access to a known bad IP address.

Final year project proposed malware detecting system for openwrt. Current develop environment: Hardware: Netgear WNDR3800 OS version: Openwrt Barrier Breaker

An Antispyware Application with optional realtime protection. Perfect for complimenting your existing AV!

EyeSpy is a is a PC/Windows based internet monitoring and visualization tool. It will scan and summarize all online activity, and display a realtime, interactive map showing the geographic location of all endpoints communicating online.