If the uploaded file is in a valid image format,
.FromStream will not throw an exception, even if it contains a virus. That is, there is no virus checking in it.
On the other hand, there is also no way for the virus to activate, since the file at this point is only being handled as raw bytes.
(It is certainly possible, if not feasible, that it contains an attack targeted directly at the .NET
Image class, e.g. via buffer overflow. However, besides being highly improbable that such a vulnerability exists, it's even more unlikely that someone will go to the trouble of targeting such a niche vector).
So, at this point you are perfectly (realistically speaking) safe, but neither do you have any idea if the file is clean or not.
The real question becomes, what happens with this file afterwards?
Is it saved to disk, and used locally?
In this case you should have some form of anti-virus check it, if only for your benefit - if you believe in them, you can just have the local AV engine scan it.
Is it later returned to other users, and thus can use your system for spreading?
You should definitely have some form of AV scan before saving the file. Note that this may not be as simple, since you might be storing the images in your database (there are AV scanners that can be activated by API for a memory segment, before it gets saved to file)... In any event, I am categorically opposed to running antivirus scans directly on your actual systems. You'd be better off having some form of gateway AV scanner, before it even hits your system.
However, take into account that when you allow random users to upload arbitrary files, virus cleaning is not the utmost of your worries.
- For one, you can be swamped - either by huge files, or many smaller ones, thus DoSing your server.
- If the user can specify the saved file path - he could potentially overwrite system files, or upload executable code.
- If file attributes are saved, and later displayed (this includes file name and username, but also description, file type, location, etc) - this can lead to other standard web attacks, such as XSS or SQL Injection.
- Do a search here for GIFAR - these are files that are both valid image files, and valid JAR (Java Archive - executable code for the browser) files. These are of course not a virus...
- Depending on the system, you may be at risk for legal damages, if your users upload e.g. copyrighted images, or e.g. child pornography. Of course, consult with your lawyer, as I am not one.
In short, accepting arbitrary uploads does lead you into a whole mess of potential trouble, and virus scanning is not the worst of it.