Member Avatar for Alphex_1

I have an anti-virus in Visual Basic .Net.

I want to have a real-time protection engine in my program, but I'm having some issues with the code I'm using now, which is this:

Private Sub FileSystemWatcher1_Changed(ByVal sender As System.Object, ByVal e As System.IO.FileSystemEventArgs) Handles FileSystemWatcher1.Changed

        Try
            labellastreal.Text = e.FullPath
            ListBox3.Items.Add(labellastreal.Text)
            Me.OpenFileDialog1.FileName = ""
            Dim scanbox As New TextBox
            scanbox.Text = My.Computer.FileSystem.ReadAllText("viruslist.txt").ToString
            Dim md5 As New MD5CryptoServiceProvider
            Dim f As New FileStream(e.FullPath, FileMode.Open, FileAccess.Read, FileShare.Read, &H2000)
            f = New FileStream(e.FullPath, FileMode.Open, FileAccess.Read, FileShare.Read, &H2000)
            md5.ComputeHash(f)
            Dim hash As Byte() = md5.Hash
            Dim buff As New StringBuilder
            Dim hashByte As Byte
            For Each hashByte In hash
                buff.Append(String.Format("{0:X2}", hashByte))
            Next
            f.Close()
            If scanbox.Text.Contains(buff.ToString) Then
                Me.OpenFileDialog1.FileName = e.FullPath
                Form2.ShowDialog()

            End If

        Catch exception1 As Exception
            ProjectData.SetProjectError(exception1)
            Dim ex As Exception = exception1
            ProjectData.ClearProjectError()
        End Try

    End Sub

The problem with this code, is that my Form2 (which is the Form that says 'virus detected') isn't showing up.

Is there something wrong with my code?

Thanks.

  • 2 Contributors
  • 1 Reply
  • 522 Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by rproffitt

Dani AI

Generated

Short answer: yes — but the symptom you see (Form2 never appears) is very likely caused by a cross-thread exception or a file-access race that your Try/Catch is silently swallowing. FileSystemWatcher events run on threadpool threads, and updating controls or showing dialogs from that thread will raise exceptions. Also, Changed can fire repeatedly while a file is being written, and the file may be locked when you try to open it.

Concrete, practical fixes to apply now:

  • Stop hiding exceptions; log them (Debug.WriteLine or a simple log file) so you can see the real error.
  • Do heavy work (hashing) off the event thread using Task.Run or a background worker.
  • Marshal any UI updates or dialogs back to the UI thread with Control.Invoke/BeginInvoke (or SynchronizationContext).
  • Use a read-with-retry strategy (or copy the file to a temp name) so you do not fail on transient locks, and debounce duplicate Changed events (timestamp + path).
  • Prefer SHA‑256 for a signature database instead of MD5 if you maintain your own hashes.
    As noted, FileSystemWatcher only covers file events; full “real time” protection that can block execution requires OS-level interception (minifilter/driver or antimalware provider integration) or using an existing AV engine.

Example pattern (VB.NET) showing background work + UI marshalling and a simple read-with-retry:

' event runs on threadpool thread
Private Sub fsw_Changed(sender As Object, e As FileSystemEventArgs) Handles fsw.Changed
    Dim path = e.FullPath
    Task.Run(Sub()
                 Dim data = ReadAllBytesWithRetry(path, 5, 200)
                 If data Is Nothing Then Return
                 Dim hash = ComputeSha256(data) ' implement hash function separately
                 If KnownVirus(hash) Then
                     Me.BeginInvoke(Sub()
                                        ' UI work on UI thread: update controls, show modal dialog
                                        Using dlg As New Form2()
                                            dlg.ShowDialog()
                                        End Using
                                    End Sub)
                 End If
             End Sub)
End Sub

Final note: for a hobby scanner this approach (watch, hash, notify) is fine; for real, preventive antivirus you need kernel/OS-level hooks and a large signature/heuristics engine. If prevention is the goal, consider integrating an existing engine or studying Windows minifilter/antimalware APIs rather than relying on FileSystemWatcher alone.

Member Avatar for rproffitt

While I think you are at least trying you left out all the other exploits in the wild. That is this would not catch web sites that mine coins and well that list of things that are considered exploits don't always involve files.

Maybe you should consider open source next time? https://windowsreport.com/open-source-antivirus/

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.