Antivirus Scanning Of Files Uploaded Via Report Manager

For those who want to know the root of my question without any of the detail:

I want to know if there is any recommended way to detect and remove potential malware from files uploaded to SQL 2005 Reporting Services via the Report Manager.

Here's a general description of our setup and challenge:

We have a Windows 2003/SQL 2005 Enterprise Server as the reporting database server and another server running Windows 2003/IIS 6.0/ColdFusion MX7/SQL 2005 Reporting Services as the web server. The Report Server is only used internally, but has a potential user community of approximately 150,000. The actual community of users who would have access to the Report Manager would be much smaller.

In our environment, we have no way of ensuring that virus scans are being performed at all of the clients, so we need a way to make sure that files uploaded through Report Manager are all being checked as they are coming in to the Report Server.

Here's what we've tried so far:


We downloaded the Eicar A/V test file and verified that Report Manager has no problem accepting it as an uploaded files by default. The servers are running Norton AntiVirus Corporate 10.2 with the latest definitions and it did not detect the virus as it was being loaded in to the database.

Next, I setup Microsoft ISA 2006 in reverse proxy mode with Kaspersky's Antivirus for ISA. Kaspersky does not prevent a client from uploading the test file to Report Manager, but it does prevent the user from downloading it, so it seems that it only works with HTTP get operations and ignores HTTP put operations.

I have had Watchguard come in with a Firebox (an appliance that they claimed could A/V scan files), but it provided similar results. Files uploaded to Report Manager were ignored, but infected files downloaded were blocked.

I have BlueCoat, TrendMicro, and CheckPoint all on tap to come in and see if they can fare any better, but I am not holding much hope for this.

I know that SharePoint has an API that virus scanners can use (VSAPI) for scanning binaries stored within its SQL database. Is there anything similar for SQL Reporting Services? Is there any other way of preventing these files from entering the application?

Thanks for reading and any responses. I am happy to provide more details if it would be helpful.