• updated to the latest changes in VirusTotal
• updated to the latest changes in Jotti
• added a new scanner site (NoVirusThanks). Unfortunately they currently seem to be down for maintenance
• disable Virscan.Org, since they are down since a couple of days (hopefully they didn’t suffer a major DDoS or a visit from the police – with them being Chinese and all)

As always, you can get it from my SVN repository.

Picture taken from Vik Nanda’s photostream with permission.

• Added support for multiple sites
• Added support for submitting via SSL (if the site supports it)
• Added support for a per-file timeout

Get it while it’s fresh from the source-code repository (to download it, click on the “View raw file” link). Some caveats though:

• Not all sites support all the features. SSL is supported only by VirusTotal at the moment for example.
• Different sites have different engines, different signature versions and so on.
• Different sites have different usage policies. Make sure to check out the policy for the given site before submitting to it. In general assume that the site can do whatever it wants with the submitted file
• Support for scanner.virus.org is broken at the moment because every scan seems to stall at 80% (at Norman), so I couldn’t get a sample of what the results look like
• Support for virscan.org is rather rudimentary because of their more complex call scheme which is needed
• To use SSL, you need to have Crypt::SSLeay installed, which under Windows means using alternative package sources.

Hope you find it useful.

Update: for those of you who prefer more asynchronous processing, there is the vtsubmit.py python script which uses the e-mail interface for VirusTotal.

Update: I did some updates to the script. Please download the new version (because the old version doesn’t really work with the changes the sites did to their architecture :-)).

Image taken from 37Hz’s photostream with permission.

I was worried that their service could be abused in an attack-by-proxy (or in this case reconnaissance-by-proxy) scenario, so I contacted them. They were kind enough to reply to me very fast, and here are the things I learned:

• They are confident that the limits set in their Terms of Service are enough. At the moment of writing this post these are the following (but they can change of course):
• There can be only one active (running) scan from one IP
• Maximum 5 scan requests from one IP per 24 hours
• Maximum 20 scan reqests from one IP per 7 days
• Scan timeout is 60 min
• An other safety measure is the fact that the logs are kept and are correlated with the requesting IP.
• When I saw the possibility to enter an arbitrary command line, I got very nervous and asked them if they considered command line injection? Thankfully they said yes and reassured me that they taken the necessary security measures (and also that their logs were full of attempts to verify the existence of an exploit)

Given all this, I can only say: scan away!