病毒检测方法
1、静态文件检测
利用文件头部相应属性的Md5值作为特征进行网络数据文件的检测，一般用于网关产品。
2、动态文件检测
将病毒文件运行到虚拟系统中，利用文件的动作行为检测是否为病毒，如杀毒软件。
利用文件头部相应属性的Md5值作为特征进行网络数据文件的检测，一般用于网关产品。
2、动态文件检测
将病毒文件运行到虚拟系统中，利用文件的动作行为检测是否为病毒，如杀毒软件。
判断文件或URL是否为恶意的主要开源网站为：virustotal.com，包含41款杀毒软件，功能非常强大，速度非常快1分钟之内完成扫描，virscan.com包含36款杀软但扫描速度慢一般需要5-15分钟。
其它网站：
http://sectools.org/tool/
http://www.malwarebytes.org/products/malwarebytes_pro/
http://www.malwarebytes.org/products/malwarebytes_pro/
http://www.malwaredomains.com/Antivirus products
- Agnitum (Agnitum)
- AhnLab (V3)
- Antiy Labs (Antiy-AVL)
- Aladdin (eSafe)
- ALWIL (Avast! Antivirus)
- AVG Technologies (AVG)
- Avira (AntiVir)
- BitDefender GmbH (BitDefender)
- ByteHero Information Security Technology Team (ByteHero)
- Cat Computer Services (Quick Heal)
- Commtouch (Command Antivirus)
- ClamAV (ClamAV)
- Comodo (Comodo)
- Doctor Web, Ltd. (DrWeb)
- Emsi Software GmbH (Emsisoft)
- Eset Software (ESET NOD32)
- Fortinet (Fortinet)
- FRISK Software (F-Prot)
- F-Secure (F-Secure)
- G DATA Software (GData)
- Hacksoft (The Hacker)
- Hauri (ViRobot)
- Ikarus Software (Ikarus)
- INCA Internet (nProtect)
- Jiangmin
- K7 Computing (K7AntiVirus)
- Kaspersky Lab (Kaspersky)
- Kingsoft (Kingsoft)
- McAfee (VirusScan)
- Microsoft (Malware Protection)
- Norman (Norman Antivirus)
- Panda Security (Panda Platinum)
- PC Tools (PCTools)
- Rising Antivirus (Rising)
- Sophos (SAV)
- Sunbelt Software (Sunbelt antivirus)
- SUPERAntiSpyware (SUPERAntiSpyware)
- Symantec AntiVirus
- TodalDefense (TotalDefense)
- Trend Micro (TrendMicro, TrendMicro-HouseCall)
- VirusBlokAda (VBA32)
File characterization tools & datasets
- Androguard (Anthony Desnos)
- Cuckoo Sandbox (Claudio Guarnieri)
- ExifTool (Phil Harvey)
- Magic descriptor (Linux)
- NSRL information (NIST's National Software Reference Library)
- PDFiD (Didier Stevens)
- pefile (Ero Carrera)
- PEiD (Jibz)
- Sigcheck (Mark Russinovich)
- ssdeep (Jesse Kornblum)
- TrID (Marco Pontello)
Website/domain scanning engines & datasets
- Alexa (Amazon)
- AlienVault (AlienVault)
- Antiy-AVL (Antiy Labs)
- Avira Checkurl (Avira)
- BitDefender (BitDefender)
- CLEAN MX (CLEAN MX)
- Comodo Site Inspector (Comodo Group)
- C-SIRT (Cyscon SIRT)
- Dr.Web Link Scanner (Dr.Web)
- EXPOSURE: Exposing Malicious Domains (iseclab.org)
- G-Data (G Data)
- Google Safebrowsing (Google)
- hpHosts (Malwarebytes)
- K7AntiVirus (K7 Computing)
- Malc0de Database (Malc0de)
- Malware Domain Blocklist (Malware Domain Blocklist)
- Malware Domain List (DNS-BH Malware Domain List)
- MalwarePatrol (MalwarePatrol)
- Minotaur (NovCon Solutions)
- Netcraft (Netcraft)
- Opera (Opera)
- Palevo Tracker (Abuse.ch)
- ParetoLogic URL Clearing House (ParetoLogic)more info
- Phishtank (OpenDNS)
- SCUMWARE (Scumware.org)
- SecureBrain (SecureBrain)
- Sophos (Sophos)
- SpyEye Tracker (Abuse.ch)
- Sucuri SiteCheck (Sucuri)
- Trend Micro Site Safety Center (Trend Micro)
- urlQuery (urlQuery.net)
- VX Vault (VX Vault)
- Websense ThreatSeeker (Websense)
- Webutation (Webutation)
- Wepawet (iseclab.org)
- WOT (Web Of Trust)
- Yandex Safebrowsing (Yandex)
- Zeus Tracker (Abuse.ch)
- Zvelo (Zvelo)
File characterization tools & datasets
- Androguard (Anthony Desnos)
- Cuckoo Sandbox (Claudio Guarnieri)
- ExifTool (Phil Harvey)
- Magic descriptor (Linux)
- NSRL information (NIST's National Software Reference Library)
- PDFiD (Didier Stevens)
- pefile (Ero Carrera)
- PEiD (Jibz)
- Sigcheck (Mark Russinovich)
- ssdeep (Jesse Kornblum)
- TrID (Marco Pontello)