search

jsakamoto / AntiVirusScanner

Anti Virus Scanner for .NET (and COM)
Mozilla Public License 2.0
25 stars 9 forks source link

How to check the requirement "IAttachmentExecute interface"? #3

Open jiji0222 opened 2 years ago

jiji0222 commented 2 years ago

I'm sorry to bother you, but please let me know.

This package is very nice. And it's working fine. (WindowsDefender)

However, I was curious about the "Any anti virus application which supported IAttachmentExecute API.

If I use an anti-virus software other than Windows Defender, how should I check this? Contact the manufacturer? Verify that it actually works? Any other way?

I did some research and didn't find a very good answer. If you know anything about it, please let me know.

jsakamoto commented 2 years ago

Unfortunately, I just wrapped the "IAttachmentExecute" so I do not understand inside of the implementation of the "IAttachmentExecute" deeply.

I saw the way to scan viruses using "IAttachmentExecute" on the source code of the Firefox Web Browser many years ago.

I think, if we should check that it would be working fine even if an anti-virus software other than Windows Defender, we may do it by scanning the "eicar" file.

  1. Install any anti-virus software (trial version of that is also OK) other than Windows Defender.
  2. Disable all anti-virus software.
  3. Scan the "eicar" file, and verify that it can not detect "eicar" as a virus. (or verify that will happen something error)
  4. Enable the anti-virus software that is not Windows Defender, and re-check it.