Ion Todirel wrote:

littleguru wrote:
Why would we need that? I mean as soon as the file is created the file system watcher of your AV detects that and checks it...
++ thats what i was thinking too, and modern AV software works pretty fast also


Only if the scanner is currently enabled, running in the background, monitoring file system change notifications for that folder, etc.

For an installer feature (like IE's ActiveX code download) then it's too late.  The installer needs to scan the file before trusting the contents or calling any code in it. 

See the Antivirus APIs for more info.  I presume that's what FF is using.

Also see http://support.microsoft.com/kb/914922 and IAttachmentExecute.