ClamAV Antivirus Scan On File Upload Content In .NET Application

Step 3. Read a file from File upload and convert to byte array.

Step 4. Scan file byte array against ClamClient and validate ClamScanResult object

ClamClient scan result returns with ClamScanResult enum values which tell you if your scan was clean or a virus was detected. Here is some sample code.

private readonly ILogger<HomeController> _logger;  
private readonly IConfiguration _configuration;  

public HomeController(ILogger<HomeController> logger, IConfiguration configuration)  
{  
    _logger = logger;  
    _configuration = configuration;  
}  

[HttpPost]  
public async Task<IActionResult> UploadFile(IFormFile file)  
{  
    if (file == null || file.Length == 0)
        return Content("file not selected");  

    var ms = new MemoryStream();  
    file.OpenReadStream().CopyTo(ms);  
    byte[] fileBytes = ms.ToArray();  
    
    try  
    {  
        _logger.LogInformation("ClamAV scan begin for file {0}", file.FileName);  
        var clam = new ClamClient(_configuration["ClamAVServer:URL"],    
                                  Convert.ToInt32(_configuration["ClamAVServer:Port"]));  
        var scanResult = await clam.SendAndScanFileAsync(fileBytes);    
        switch (scanResult.Result)  
        {  
            case ClamScanResults.Clean:  
                _logger.LogInformation("The file is clean! ScanResult: {1}", scanResult.RawResult);  
                break;  
            case ClamScanResults.VirusDetected:  
                _logger.LogError("Virus Found! Virus name: {1}", scanResult.InfectedFiles.FirstOrDefault().VirusName);  
                break;  
            case ClamScanResults.Error:  
                _logger.LogError("An error occurred while scanning the file! ScanResult: {1}", scanResult.RawResult);  
                break;  
            case ClamScanResults.Unknown:  
                _logger.LogError("Unknown scan result while scanning the file! ScanResult: {0}", scanResult.RawResult);  
                break;  
        }  
    }  
    catch (Exception ex)  
    {  
        _logger.LogError("ClamAV Scan Exception: {0}", ex.ToString());  
    }  
    
    _logger.LogInformation("ClamAV scan completed for file {0}", file.FileName);  
    return RedirectToAction("Index");  
}

In case you have file content in base 64 strings, then convert it to a byte array and send the same byte array to ClamClient for scanning.

Step 5. Test ClamAV scan against a valid file.

Now we are ready to test our code against a valid PDF and images.

Step 6. Test ClamAV scan against an Anti Malware test file.

As a POC, the EICAR file was uploaded. This is a sample file used to test the response of anti-virus software. You can download a sample file from https://www.eicar.org/?page_id=3950. You may need to pause your antivirus protection on your device to perform this activity.

The below information is from the application console log,

Conclusion

In this article, we have seen how to run ClamAV in localhost using a docker image and implemented and tested an antivirus scan with a valid file and a virus-infected file. The application identified the upload of this file with the scan result, now you can add your logic to remove the file. Hope you found this information useful! Sharing is caring.