.NET virus scanning API

Question

I\'m building a web application in which I need to scan the user-uploaded files for viruses.

Does anyone with experience in building something like this can provide

Answer 1

From my experience you can use COM for interfacing with some anti-virus software. But what I would suggest is a bit easier, just parse scan results after scanning. All you need to do is to start the scanner process and point it to file/folder you want to scan, store scan results into file or redirect stdout to your application and parse results.

Answer 2

Take a look at the Microsoft Antivirus API. It makes use of COM, which should be easy enough to interface with from .NET. It refers specifically to Internet Explorer and Microsoft Office, but I don't see why you wouldn't be able to use to to on-demand scan any file.

All modern scanners that run on Windows should understand this API.

Answer 3

You can try to use DevDragon.io.

It is a web service with an API and .NET client DevDragon.Antivirus.Client you can get from NuGet. Scans are sub 200ms for 1MB file.

More documentation here: https://github.com/Dev-Dragon/Antivirus-Client

Disclosure: I work for them.

Answer 4

Various Virus scanners do have API's. One I have integrated with is Sophos. I am pretty sure Norton has an API also while McAfee doesn't (it used to). What virus software do you want to use? You may want to check out Metascan as it will allow integration with many different scanners, but there is an annual license cost. :-P

Answer 5

Important note before use: Be aware of TOS agreement. You give them full access to everything: "When you upload or otherwise submit content, you give VirusTotal (and those we work with) a worldwide, royalty free, irrevocable and transferable licence to use, edit, host, store, reproduce, modify, create derivative works, communicate, publish, publicly perform, publicly display and distribute such content."

Instead of using a local Antivirus program (and thus binding your program to that particular Antivirus product and requesting your customers to install that Antivirus product) you could use the services of VirusTotal.com

This site provides a free service in which your file is given as input to numerous antivirus products and you receive back a detailed report with the evidences resulting from the scanning process. In this way your solution is no more binded to a particular Antivirus product (albeit you are binded to Internet availability)

The site provides also an Application Programming Interface that allows a programmatically approach to its scanning engine.

Here a VirusTotal.NET a library for this API
Here the comprensive documentation about their API
Here the documentation with examples in Python of their interface

And because no answer is complete without code, this is taken directly from the sample client shipped with the VirusTotal.NET library

static void Main(string[] args)
{
    VirusTotal virusTotal = new VirusTotal(ConfigurationManager.AppSettings["ApiKey"]);

    //Use HTTPS instead of HTTP
    virusTotal.UseTLS = true;

    //Create the EICAR test virus. See http://www.eicar.org/86-0-Intended-use.html
    FileInfo fileInfo = new FileInfo("EICAR.txt");
    File.WriteAllText(fileInfo.FullName, @"X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");

    //Check if the file has been scanned before.
    FileReport fileReport = virusTotal.GetFileReport(fileInfo);

    bool hasFileBeenScannedBefore = fileReport.ResponseCode == ReportResponseCode.Present;

    Console.WriteLine("File has been scanned before: " + (hasFileBeenScannedBefore ? "Yes" : "No"));

    //If the file has been scanned before, the results are embedded inside the report.
    if (hasFileBeenScannedBefore)
    {
        PrintScan(fileReport);
    }
    else
    {
        ScanResult fileResult = virusTotal.ScanFile(fileInfo);
        PrintScan(fileResult);
    }
    ... continue with testing a web site ....

}

DISCLAIMER
I am in no way involved with them. I am writing this answer just because it seems to be a good update for these 4 years old answers.