# Advanced Virus Checker Addon

https://docs.wisecp.com/es/advanced-virus-checker-addon

Advanced Virus Checker sends the files your clients upload to the antivirus service you choose. It labels every file Safe or Unsafe.

## Reaching the Screen

Go to **Tools → Add-ons → Advanced Virus Checker**: `{admin}/tools/addons/AdvancedVirusChecker`

> **Premium Feature**
> 
> This module is included with the **Business Plan** at no additional cost. On other WISECP license plans you can add it to your existing license.

Three conditions must hold together before anything is scanned. The add-on must be on, the license must be valid, and the selected engine must have a stored API key.

## What Is on the Screen

| Section | What it shows |
| --- | --- |
| Status strip | Tells you whether the module runs, which engine it uses and how the license stands. The **License** button on the right opens the purchase panel. |
| Threat band | Appears only when an unsafe file exists. It names the most recently flagged file. |
| Scan Engine | The list on the left holds four antivirus services. The panel on the right carries the API key of the one you selected. |
| Scan History | Lists every file that was scanned. Search, sorting and export live here. |

### Engine list

Selecting a service in the list only opens it. The **Use for New Scans** switch inside the panel decides which service actually scans. That way you can store a spare key without switching services. A small broadcast mark sits next to the service in use.

### Result column

A result is shown as an engine ratio. `0/74` means "74 engines looked, none flagged it". When the bar under it is filled, the file was flagged. On unsafe rows the **Report** link opens the service's own page.

### Counters are also filters

The **All**, **Clean** and **Threats** counters above the list can be clicked. The one you click narrows the list to those files. **Scanning** and **Errors** appear only when such records exist.

### Smart cache

The same file is never sent to the service twice. If content that was scanned before turns up on another record, the stored result is reused. A small lightning mark appears on that row.

## Engine Settings

- **Use for New Scans**: Required. Only the engine switched on runs new scans; the keys of the others are still kept.
- **VirusTotal API Key**: Required if VirusTotal is used. Leaving it blank keeps the stored key.
- **MetaDefender API Key**: Required if MetaDefender is used. Leaving it blank keeps the stored key.
- **PolySwarm API Key**: Required if PolySwarm is used. Leaving it blank keeps the stored key.
- **Kaspersky OpenTIP API Key**: Required if Kaspersky OpenTIP is used. Leaving it blank keeps the stored key.

## Setup and Use

### Connecting an engine

1. Click a service in the list on the left. The panel on the right shows its settings.
2. Type the key you obtained from the service into **API Key**. The link under the field takes you to that service's key page.
3. Click **Test Connection**. A green **Connected** mark next to it means the key is valid.
4. Turn on **Use for New Scans** and click **Save Settings**. The engine is then used by new scans.

### Scanning a file

1. Click the scan button next to the attachment on a ticket, service, client document or SMS application page.
2. Wait for the result. A **Scanning** state does not mean the file is safe.
3. On an unsafe result, do not open the file and follow your organization's incident policy. The add-on never deletes or blocks a file.

### Reviewing the history

1. Click the **Threats** counter above the list. The list then shows flagged files only.
2. To see one source, pick it from the **All Sources** list on the right.
3. Use the list's search box to find a file by name. Click a column header to sort.

### Rotating a key or switching engines

1. Wait for running scans to finish. If the engine changes while an analysis is open, that scan is recorded as an error.
2. Enter the new key, confirm it with **Test Connection**, then save.
3. Confirm that new rows show the new engine. Older rows keep the engine that produced their verdict.

## Things to Watch

> **This is on-demand analysis, not quarantine**
> 
> Files are not automatically blocked or deleted. Staff must wait for the verdict and follow the organization’s response policy.

> **Files leave WISECP**
> 
> Unknown files can be uploaded to the active external provider and the global limit is 32 MB. Provider retention, billing and data-handling terms apply.

> **Cache follows file content**
> 
> An identical SHA-256 can reuse a conclusive verdict across sources. Use forced rescan when policy requires new threat intelligence.

## Privileges

**Tools Add-ons** (`TOOLS_ADDONS`) is required for provider configuration and history. Each scan button additionally requires the ticket, service, client document-verification or product privilege protecting its source file.

## Related Screens

- [Ticket Detail](https://docs.wisecp.com/en/ticket-detail)
- [Document Verification Records](https://docs.wisecp.com/en/document-verification-records)
- [Products](https://docs.wisecp.com/en/product-list)