См. Хороший ответ человека на мой другой вопрос.
Похоже, вам нужно взять два COM-интерфейса, один из которых описан здесь:
IAttachmentExecute
Этот интерфейс является частью интерфейсов оболочки Windows.
вот комментарий в источнике
/**
* Code overview
*
* Download scanner attempts to make use of one of two different virus
* scanning interfaces available on Windows - IOfficeAntiVirus (Windows
* 95/NT 4 and IE 5) and IAttachmentExecute (XPSP2 and up). The latter
* interface supports calling IOfficeAntiVirus internally, while also
* adding support for XPSP2+ ADS forks which define security related
* prompting on downloaded content.
*
* Both interfaces are synchronous and can take a while, so it is not a
* good idea to call either from the main thread. Some antivirus scanners can
* take a long time to scan or the call might block while the scanner shows
* its UI so if the user were to download many files that finished around the
* same time, they would have to wait a while if the scanning were done on
* exactly one other thread. Since the overhead of creating a thread is
* relatively small compared to the time it takes to download a file and scan
* it, a new thread is spawned for each download that is to be scanned. Since
* most of the mozilla codebase is not threadsafe, all the information needed
* for the scanner is gathered in the main thread in nsDownloadScanner::Scan::Start.
* The only function of nsDownloadScanner::Scan which is invoked on another
* thread is DoScan.
Я нашел больше информации о реализации здесь. Функция называется AES.