Antivirus APIs and Alliances

At the RSA Conference 2003 in April, Microsoft made several API-related announcements, including a new filter manager architecture for Windows, a new version of the Exchange Virus Scan API, and improvements to Word to make virus detection easier.

Windows File System Filter Manager Architecture. Planned for future versions of Windows (such as Longhorn), this new architecture will simplify integration of antivirus software with Windows by supplying a filter and driver architecture. This programming model allows filter drivers (which antivirus software use to examine the file content) to be layered above the NT file system (NTFS) and other file system drivers, allowing Microsoft and third-party developers to better support a range of products, such as antivirus, enhanced quota management, content screening, encryption, replication, and storage area network (SAN) file system support.

Microsoft will provide a filter driver into which third parties can plug product-specific mini-filters. Among other things, Microsoft says this architecture will allow multiple antivirus software products to coexist and run simultaneously on a single PC. (Microsoft has revealed few details about this architecture publicly, although a design preview has been held with antivirus software developers.)