public void RescanKnownFile()
{
//Create the EICAR test virus. See http://www.eicar.org/86-0-Intended-use.html
FileInfo fileInfo = new FileInfo("EICAR.txt");
File.WriteAllText(fileInfo.FullName, @"X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
ScanResult fileResult = _virusTotal.RescanFile(fileInfo);
//It should always be in the VirusTotal database. We expect it to rescan it
Assert.AreEqual(ScanResponseCode.Queued, fileResult.ResponseCode);
}
private static void FileScan(string file, bool rescan)
{
try
{
VirusTotal virusTotal = new VirusTotal(api_key);
virusTotal.UseTLS = true;
FileInfo fileInfo = new FileInfo(file);
FileReport fileReport = virusTotal.GetFileReport(fileInfo);
bool hasFileBeenScannedBefore = fileReport.ResponseCode == ReportResponseCode.Present;
Console.WriteLine("File has been scanned before: " + (hasFileBeenScannedBefore ? "Yes" : "No"));
if (hasFileBeenScannedBefore)
{
if (rescan)
{
ScanResult fileResult = virusTotal.RescanFile(fileInfo);
PrintScan(fileResult);
}
else
{
PrintScan(fileReport);
}
}
else
{
ScanResult fileResult = virusTotal.ScanFile(fileInfo);
PrintScan(fileResult);
}
}
catch (Exception e)
{
Console.WriteLine(e.Message);
}
}
public async Task RescanLargeFile()
{
IgnoreMissingJson(" / Permalink", " / scan_id", " / SHA256");
//Since rescan works on hashes, we expect the hash of this empty file (which is larger than the limit) is not present in the database.
byte[] bytes = new byte[99 * 1023 * 1024]; //the weird size is because VT has some weird empty files in its database.
string hash = HashHelper.GetMD5(bytes);
RescanResult result = await VirusTotal.RescanFile(hash);
Assert.Equal(ScanResponseCode.Error, result.ResponseCode);
}
public async Task RescanUnknownFile()
{
IgnoreMissingJson(" / Permalink", " / scan_id", " / SHA256");
FileInfo fileInfo = new FileInfo("VirusTotal.NET-Test.txt");
File.WriteAllText(fileInfo.FullName, "VirusTotal.NET" + Guid.NewGuid());
RescanResult fileResult = await VirusTotal.RescanFile(fileInfo);
//It should not be in the VirusTotal database already, which means it should return error.
Assert.Equal(ScanResponseCode.Error, fileResult.ResponseCode);
}