Is there a method to programmatically designate a specific antivirus (AV) for scanning with AMSI if multiple AVs are concurrently active on the system?

Question

I'm seeking guidance on managing antivirus (AV) selection programmatically within the context of using the Antimalware Scan Interface (AMSI). In my scenario, multiple AV solutions might be present and active on a system. I need to implement a method to dynamically choose one specific AV for file scanning purposes when invoking AMSI. This selection process is crucial for ensuring efficient and effective malware detection and mitigation within my application. Any insights or suggestions on how to achieve this programmatically would be greatly appreciated.

Answer 1

Hello @PradeepKumar Yadav,

According to Third-party creators of antimalware products, you can specify the AMSI provider for example SampleAmsiProvider in IAntimalware::Scan.

As a creator of antimalware products, you can choose to author and register your own in-process COM server (a DLL) to function as an AMSI provider. That AMSI provider must implement the IAntimalwareProvider interface, and it must run in-process.