C# .NET 病毒扫描 API
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/975112/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
.NET virus scanning API
提问by Farinha
I'm building a web application in which I need to scan the user-uploaded files for viruses.
我正在构建一个 Web 应用程序，我需要在其中扫描用户上传的文件是否有病毒。
Does anyone with experience in building something like this can provide information on how to get this up and running? I'm guessing antivirus software packages have APIs to access their functionality programatically, but it seems it's not easy to get a hand on the details.
有没有构建过这样的东西的经验的人可以提供有关如何启动和运行它的信息？我猜防病毒软件包有 API 可以以编程方式访问它们的功能，但似乎不太容易掌握细节。
FYI, the application is written in C#.
仅供参考，该应用程序是用 C# 编写的。
采纳答案by Joe
I would probably just make a system call to run an independent process to do the scan. There are a number of command-line AV engines out there from various vendors.
我可能只是进行系统调用来运行一个独立的进程来进行扫描。有许多来自不同供应商的命令行 AV 引擎。
回答by msuvajac
From my experience you can use COM for interfacing with some anti-virus software. But what I would suggest is a bit easier, just parse scan results after scanning. All you need to do is to start the scanner process and point it to file/folder you want to scan, store scan results into file or redirect stdout to your application and parse results.
根据我的经验，您可以使用 COM 与某些防病毒软件进行交互。但我建议的更容易一些，只需在扫描后解析扫描结果。您需要做的就是启动扫描程序进程并将其指向您要扫描的文件/文件夹，将扫描结果存储到文件中或将标准输出重定向到您的应用程序并解析结果。
回答by Craig
Various Virus scanners do have API's. One I have integrated with is Sophos. I am pretty sure Norton has an API also while McAfee doesn't (it used to). What virus software do you want to use? You may want to check out Metascanas it will allow integration with many different scanners, but there is an annual license cost. :-P
各种病毒扫描程序都有 API。我与之集成的一个是 Sophos。我很确定诺顿也有一个 API，而迈克菲没有（它曾经有）。您要使用什么病毒软件？您可能想要查看Metascan，因为它允许与许多不同的扫描仪集成，但每年需要支付许可费用。:-P
回答by Thorarin
Take a look at the Microsoft Antivirus API. It makes use of COM, which should be easy enough to interface with from .NET. It refers specifically to Internet Explorer and Microsoft Office, but I don't see why you wouldn't be able to use to to on-demand scan any file.
查看Microsoft Antivirus API。它使用 COM，它应该很容易与 .NET 进行交互。它特指 Internet Explorer 和 Microsoft Office，但我不明白为什么您不能使用 来按需扫描任何文件。
All modern scanners that run on Windows should understand this API.
所有在 Windows 上运行的现代扫描仪都应该理解这个 API。
回答by Steve
Important note before use:Be aware of TOS agreement. You give them full access to everything: "When you upload or otherwise submit content, you give VirusTotal (and those we work with) a worldwide, royalty free, irrevocable and transferable licence to use, edit, host, store, reproduce, modify, create derivative works, communicate, publish, publicly perform, publicly display and distribute such content."
使用前的重要注意事项：注意 TOS 协议。您授予他们对所有内容的完全访问权限：“当您上传或以其他方式提交内容时，您授予 VirusTotal（以及与我们合作的人）一个全球性、免版税、不可撤销和可转让的许可，以使用、编辑、托管、存储、复制、修改、创作衍生作品、传播、出版、公开表演、公开展示和分发此类内容。”
Instead of using a local Antivirus program (and thus binding your program to that particular Antivirus product and requesting your customers to install that Antivirus product) you could use the services of VirusTotal.com
您可以使用VirusTotal.com的服务，而不是使用本地防病毒程序（从而将您的程序绑定到该特定防病毒产品并要求您的客户安装该防病毒产品）
This site provides a free service in which your file is given as input to numerous antivirus products and you receive back a detailed report with the evidences resulting from the scanning process. In this way your solution is no more binded to a particular Antivirus product (albeit you are binded to Internet availability)
该站点提供免费服务，在该服务中，您的文件将作为输入提供给众多防病毒产品，并且您会收到一份包含扫描过程产生的证据的详细报告。通过这种方式，您的解决方案不再受特定防病毒产品的约束（尽管您受 Internet 可用性的约束）
The site provides also an Application Programming Interface that allows a programmatically approach to its scanning engine.
该站点还提供了一个应用程序编程接口，允许以编程方式访问其扫描引擎。
Here a VirusTotal.NET a library for this API
Here the comprensive documentation about their API
Here the documentation with examples in Python of their interface
这里有一个 VirusTotal.NET 这个 API 的库
这里有关于他们的 API 的综合文档
这里有他们接口的 Python 示例文档
And because no answer is complete without code, this is taken directly from the sample client shipped with the VirusTotal.NET library
并且因为没有代码就没有完整的答案，这直接取自 VirusTotal.NET 库附带的示例客户端
static void Main(string[] args)
{
VirusTotal virusTotal = new VirusTotal(ConfigurationManager.AppSettings["ApiKey"]);
//Use HTTPS instead of HTTP
virusTotal.UseTLS = true;
//Create the EICAR test virus. See http://www.eicar.org/86-0-Intended-use.html
FileInfo fileInfo = new FileInfo("EICAR.txt");
File.WriteAllText(fileInfo.FullName, @"X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
//Check if the file has been scanned before.
FileReport fileReport = virusTotal.GetFileReport(fileInfo);
bool hasFileBeenScannedBefore = fileReport.ResponseCode == ReportResponseCode.Present;
Console.WriteLine("File has been scanned before: " + (hasFileBeenScannedBefore ? "Yes" : "No"));
//If the file has been scanned before, the results are embedded inside the report.
if (hasFileBeenScannedBefore)
{
PrintScan(fileReport);
}
else
{
ScanResult fileResult = virusTotal.ScanFile(fileInfo);
PrintScan(fileResult);
}
... continue with testing a web site ....
}
}
DISCLAIMER
I am in no way involved with them. I am writing this answer just because it seems to be a good update for these 4 years old answers.
免责声明
我与他们没有任何关系。我写这个答案只是因为它似乎是对这些 4 年前的答案的一个很好的更新。
回答by Priya Premkumar
//Scan
string start = Console.ReadLine();
System.Diagnostics.Process scanprocess = new System.Diagnostics.Process();
sp.StartInfo.WorkingDirectory = @"<location of your antivirus>";
sp.StartInfo.UseShellExecute = false;
sp.StartInfo.FileName = "cmd.exe";
sp.StartInfo.Arguments = @"/c antivirusscanx.exe /scan="+filePath;
sp.StartInfo.CreateNoWindow = true;
sp.StartInfo.RedirectStandardInput = true;
sp.StartInfo.RedirectStandardError = true; sp.Start();
string output = sp.StandardOutput.ReadToEnd();
//Scan results
System.Diagnostics.Process pr = new System.Diagnostics.Process();
pr.StartInfo.FileName = "cmd.exe";
pr.StartInfo.Arguments = @"/c echo %ERRORLEVEL%";
pr.StartInfo.RedirectStandardInput = true;
pr.StartInfo.RedirectStandardError = true; pr.Start();
output = processresult.StandardOutput.ReadToEnd();
pr.Close();
回答by Rafael Ferreira
Shameless plug but you might want to check out https://scanii.com, it's basically malware/virus detection as a (REST) service. Oh also, make sure you read and understand virustotal's API terms (https://www.virustotal.com/en/documentation/public-api/) - they are very clear about not allowing commercial usage.
无耻的插件，但您可能想查看https://scanii.com，它基本上是作为 (REST) 服务的恶意软件/病毒检测。另外，请确保您阅读并理解了virustotal 的API 条款（https://www.virustotal.com/en/documentation/public-api/）——他们非常清楚不允许商业用途。
回答by Fred
You can use IAttachmentExecute API.
您可以使用 IAttachmentExecute API。
Windows OS provide the common API to calling the anti virus software which is installed (Of course, the anti virus software required support the API). But, the API to calling the anti virus software provide only COM Interface style, not supported IDispatch. So, calling this API is too difficult from any .NET language and script language.
Windows 操作系统提供通用 API 来调用已安装的杀毒软件（当然，所需的杀毒软件支持该 API）。但是，调用杀毒软件的API只提供COM接口样式，不支持IDispatch。所以，从任何 .NET 语言和脚本语言调用这个 API 都太困难了。
Download this library from here Anti Virus Scanner for .NETor add reference your VS project from "NuGet" AntiVirusScanner
从这里下载这个库用于 .NET 的 Anti Virus Scanner或从“NuGet” AntiVirusScanner添加引用您的 VS 项目
For example bellow code scan a file :
例如下面的代码扫描一个文件：
var scanner = new AntiVirus.Scanner();
var result = scanner.ScanAndClean(@"c:\some\file\path.txt");
Console.WriteLine(result); // console output is "VirusNotFound".
回答by Andrew
You can try to use DevDragon.io.
您可以尝试使用 DevDragon.io。
It is a web service with an API and .NET client DevDragon.Antivirus.Client you can get from NuGet. Scans are sub 200ms for 1MB file.
它是一个带有 API 和 .NET 客户端 DevDragon.Antivirus.Client 的 Web 服务，您可以从 NuGet 获取。1MB 文件的扫描时间低于 200 毫秒。
More documentation here: https://github.com/Dev-Dragon/Antivirus-Client
更多文档在这里：https: //github.com/Dev-Dragon/Antivirus-Client
Disclosure: I work for them.
披露：我为他们工作。
回答by Nithin Chandran
I also had this requirement. I used clamAv anti virus which provides on-demand scanning by sending the file to their tcp listening port. You can use nClamnuget package to send files to clamav.
我也有这个要求。我使用了 clamAv 防病毒软件，它通过将文件发送到他们的 tcp 侦听端口来提供按需扫描。您可以使用nClamnuget 包将文件发送到clamav.
var clam = new ClamClient("localhost", 3310);
var scanResult = clam.ScanFileOnServerAsync("C:\test.txt"); //any file you would like!
switch (scanResult.Result.Result)
{
case ClamScanResults.Clean:
Console.WriteLine("The file is clean!");
break;
case ClamScanResults.VirusDetected:
Console.WriteLine("Virus Found!");
Console.WriteLine("Virus name: {0}", scanResult.Result.InfectedFiles[0].FileName);
break;
case ClamScanResults.Error:
Console.WriteLine("Woah an error occured! Error: {0}", scanResult.Result.RawResult);
break;
}
A simple and detailed example is shown here. Note:- The synchronous scan method is not available in the latest nuget. You have to code like I done above
此处显示了一个简单而详细的示例。注意：- 同步扫描方法在最新的 nuget 中不可用。你必须像我上面那样编码
For testing a virus you can use the below string in a txtfile
为了测试病毒，您可以在txt文件中使用以下字符串
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE！$H+H*
