Is it possible to safely watch a specific folder with virus scan on Windows Server?

Question

I have a website that must allow numerous file types to be uploaded, some of which could possibly be dangerous, such as a word document. There's only a single website on this server that allows this.

I suppose my question is two-fold, which I'm finding myself LOST in arguments/debates back and forth in other threads:

1. Is there any type of virus or malicious file that can execute on its own without being manually executed? A customer uploads a word document that has a macro virus attached that they're completely unaware of. All customer uploads are stored in a single directory with subfolders based on their UserID. This file would never be executed "manually" from a server admin. It would be downloaded to an admin's personal computer through a web interface where they would do a VS prior to opening it.

2. Is it possible or would it be sufficient enough to use a Virus Scan that "watches" just this one folder and scans files immediately?

The execution part is what is really confusing me. In a live case scenario, an admin would click on the file, and the web-server would send the file to that admin's computer, where they can easily scan it for a virus before opening it.

So my question is more related to the server's protection itself.

I'm not sure how to narrow down my question better, but I hope it makes sense, and I appreciate any feedback.

Answer 1

Is there any type of virus or malicious file that can execute on its own
without being manually executed?

As long as something is done with a file the content could trigger a bug (or backdoor)
in the processing software. This means "Yes", eg. the upload to the server could be
enough without you manually clicking on a file.

Is it possible or would it be sufficient enough to use a Virus Scan that "watches"
just this one folder and scans files immediately?

If it is possible depends on the AV software. But sufficient [to prevent any malicious
actions on the server] ? Not at all. There is no AV software with 100% percent
correct recognition.

...the only "sufficient" security against malware is to turn the server off and melt it.

Answer 2

Is there any type of virus or malicious file that can execute on its own without being manually executed?

To build on deviantfan's answer, it's important to think about the stages through which a file will progress as it's uploaded to your server and saved to disk.

As the client's browser is transferring this file to you, your server will almost certainly have to have this file or parts of this file in memory at some point (I assume you'll save some kind of data about the file to a database or something like that).

A very cleverly crafted exploit hidden in the file itself could cause your server to execute something it isn't supposed to during this process of receiving and saving the file.

There's also a number of things that could be running in the background on your server, i.e an indexing daemon that could open the file to try and index its contents. Automatic indexation has been known to create exploitable vulnerabilities by using specially crafted files.

Unfortunately in these cases your server will have already been compromised even before the anti virus software gets a chance to scan the file on disk. And as deviantfan pointed out, even the best anti virus products won't protect you against currently unknown vulnerabilities.