Virus Scanning of Binaries -- Blobs vs. Files [closed]

Question

There has been a lot of discussion on SO about using blobs vs. files to store binaries, but the current issue I'm facing involves virus scanning. There are likely a lot of APIs that can be used to scan files saved to a file system. Are there any for blobs? Are there APIs that can be given streams or byte[]s and told to scan them for viruses and malware? If so, does anybody have any recommendations? Or is this yet another reason to steer clear of blobs?

FYI - I'm using C# and MongoDb right now for my blobs.

Farandole

Are you looking for free, open source, or commercial antivirus API's? – Cissiee

Any of those work -- as long as they work... – Farandole

Answer 1

I was in need of a solution that the question was asking about. I evaluated a lot of things and came to the conclusion that there was really not one good .NET library for this. So I made my own.

The library is called nClam, and it connects to a ClamAV server. It is open-source (Apache License 2.0) library which has a very simple API. You can obtain it here: https://github.com/tekmaven/nClam. There is also a nuget package: nClam. I also have some instructions on how to set up the ClamAV server on my blog, here: http://architectryan.com/2011/05/19/nclam-a-dotnet-library-to-virus-scan/.

Mcdade

Can you install ClamAV server on Windows Server 2008? How do ClamAV maintain the virus updates on my server? I got a web application running on that server which has an upload function. I need to scan the files stream before sending it off to the file server. – Gizmo

Answer 2

I don't know if APIs exist for scanning in-memory data (I haven't found any), but you can always put your binary data into a temporary file, scan the file (by calling an external program working in command line) and delete it when it's done.

Tymes

Answer 3

Certainly Sophos's API (SAVI) can scan arbitrary memory buffers - you can provide call-backs for accessing the data, so it can be any data you can access.

Tunnel