Take the 2-minute tour ×

Is there any free antivirus API exists which I can implement in my ASP.NET website and scan files that are uploaded by the user onto my server? I cannot install an antivirus on my hosting provider's server because they don't allow it.

share|improve this question
Pardon my lack of knowledge on this topic, but would the file not have to be executed to cause a problem? If the file is just uploaded by a user, could this cause actual harm? –  david99world Jan 10 '13 at 15:56
@david99world I guess he doesn't want to host a virus since that's a danger to downloading users and also might hurt the website's reputation. –  CodesInChaos Jan 10 '13 at 15:57
@david99world people can upload an infected file. Just for play or by mistake. Or a bot can do that. A simple virus that coded to delete all files in the folder where it is uploaded, will take down our whole website. –  Shiva Pareek Jan 10 '13 at 16:34
@Shiva: only if you executed it, and there's no good reason ever to execute user-uploaded content. There are many problems with accepting user-uploaded content, to do with cross-site-scripting and insecure filename handling, but typically traditional 'viruses' are the least of your worries. –  bobince Jan 10 '13 at 21:06

3 Answers 3

up vote 7 down vote accepted

Microsoft has one that seems to be free.


If you want something with what seems to be more "power" (not free):


By using many antivirus engines from vendors like ESET, AVG, Microsoft , Bitdefender, Symantec, F-Secure, GFI, Kaspersky, and McAfee, Metascan technology increases zero hour detection rates for all types of malware without the hassle of licensing, modifying, and maintaining multiple antivirus engines. All engines integrated into Metascan products are optimized to scan simultaneously for fast, high performance scanning.

If you want to roll your own, and you understand security

Create a sandboxed environment where you deploy code, each file that comes through is opened in a non-networked VM. If the VM does not detect any anomalies the file is "clean" and can be passed on to the users. Now the interesting thing about this approach is you have to run the file multiple times in multiple vms. The reason for this is the more clever malware will change its signature / file structure on each invocation or after X invocations. This is where the use of VMS and heavy logging can reduce the potential spread of these types of programs. Now the other nice thing is you can turn around and sell this information to other companies that may not have yet seen these malicious pieces of software.



Also the API from Microsoft, as you said it only scan automatic code. What is this automatic code? Can you please explain. And how can I use it if it does not support file scanning?

I believe automatic code refers to things such as JavaScript and ActiveX components.

You would use it as a wrapper / architecture to implement your own custom file scanning. Now what that means is you need to establish a white list of acceptable files and seek out common attack patterns, such as command injection. While this is a bit tedious and very intense, it does give a full spectrum view of what needs to be done to prevent malicious code from executing.

share|improve this answer
Nice list of options @Woot4Moo . I am not so pro in Web Development and we don't have our own servers for implementing our own security system. Also the API from Microsoft, as you said it only scan automatic code. What is this automatic code? Can you please explain. And how can I use it if it does not support file scanning? –  Shiva Pareek Jan 10 '13 at 16:29
@ShivaPareek updated to provide more explanation. –  Woot4Moo Jan 10 '13 at 17:29
The Microsoft "API" is not an API in the sense you're looking for. "The Antivirus API enables software vendors to design and implement antivirus applications that interface with host applications such as Microsoft Office 2000 and Microsoft Internet Explorer 5." This is an interface that anti-virus vendors can implement so that Office 2000 can call their products. Note that's Office 2000 and IE 5. –  John Saunders Jan 11 '13 at 4:56
Thanks @Woot4Moo. The conclusion is that I have to create my own virus scanning system or a sandbox type system. Well I will see what can I do to achieve that. Thanks for the valuable information you provided. –  Shiva Pareek Jan 11 '13 at 17:47
As wootmoo has stated above you may want to check Metascan which provides a public API to many antivirus packages that support Java. It is described at metascan-online.com/en/public-api More details available here ----> metascan-online.com/en –  Rahul Mangalore Oct 17 '13 at 23:43

You would probably have to create your own wrapper around an anti-virus command line scanner. Most commercial anti-virus' ship with one, if not they are usually available as an optional download.

As a warning - most anti-virus companies won't allow you to use their engine as a 'service' like this. Yes companies like 'virustotal' exist, but they are in collaboration with the companies whose scanners they use.

share|improve this answer
Actually I cannot install an anti-virus on the server, because I am using a hosting service from other company. So we don't have access to the system's command-line. Thats why I was asking for programming related solution. –  Shiva Pareek Jan 10 '13 at 16:32
I understood that, but I was talking about hosting the solution above on another server and then you would have to create your own API. –  Hzmy Jan 11 '13 at 22:25

Since you can't install anything on the server it sounds your only option is an API you can interface with for arbitration, that is the ability to accept user content and validate that is free from malicious content before exposing it to other users.

A bit of a shameless plug but scanii.com might be exactly what you are looking for, it gives you a simple json http API you can interface with for this type of content arbitration (oh and shenanigans free since it's not associated with any AV vendor). Here's an example of that integration https://scanii.com/docs/virus-scanning-your-s3-content/

share|improve this answer

Your Answer


