well before you can make an AV program you need to do quite a bit of reading. first of all you need to learn how most viruses work. and also you will need to know how most common AV programs idenify a virus. most often it is done through signitures. the SIG is a peace of code or Peace of HEX code that is common to a virus or kind of virus. one you have incountered a virus and flagged it as a virus you can then get its SIG and keep it in file for when you do a scan. so all you really in theroy need to do is to write a program that can look at the HEX of a program and compare it to the SIG you have gathered prevously.