I have a website that must allow numerous file types to be uploaded, some of which could possibly be dangerous, such as a word document. There's only a single website on this server that allows this.
I suppose my question is two-fold, which I'm finding myself LOST in arguments/debates back and forth in other threads:
Is there any type of virus or malicious file that can execute on its own without being manually executed? A customer uploads a word document that has a macro virus attached that they're completely unaware of. All customer uploads are stored in a single directory with subfolders based on their UserID. This file would never be executed "manually" from a server admin. It would be downloaded to an admin's personal computer through a web interface where they would do a VS prior to opening it.
Is it possible or would it be sufficient enough to use a Virus Scan that "watches" just this one folder and scans files immediately?
The execution part is what is really confusing me. In a live case scenario, an admin would click on the file, and the web-server would send the file to that admin's computer, where they can easily scan it for a virus before opening it.
So my question is more related to the server's protection itself.
I'm not sure how to narrow down my question better, but I hope it makes sense, and I appreciate any feedback.