See the nice person's answer to my other question.
Looks like there are two COM interfaces you should be grabbing, one of which is documented here:
IAttachmentExecute
This interface is part of the windows shell interfaces.
here is the commentary in the source
/**
* Code overview
*
* Download scanner attempts to make use of one of two different virus
* scanning interfaces available on Windows - IOfficeAntiVirus (Windows
* 95/NT 4 and IE 5) and IAttachmentExecute (XPSP2 and up). The latter
* interface supports calling IOfficeAntiVirus internally, while also
* adding support for XPSP2+ ADS forks which define security related
* prompting on downloaded content.
*
* Both interfaces are synchronous and can take a while, so it is not a
* good idea to call either from the main thread. Some antivirus scanners can
* take a long time to scan or the call might block while the scanner shows
* its UI so if the user were to download many files that finished around the
* same time, they would have to wait a while if the scanning were done on
* exactly one other thread. Since the overhead of creating a thread is
* relatively small compared to the time it takes to download a file and scan
* it, a new thread is spawned for each download that is to be scanned. Since
* most of the mozilla codebase is not threadsafe, all the information needed
* for the scanner is gathered in the main thread in nsDownloadScanner::Scan::Start.
* The only function of nsDownloadScanner::Scan which is invoked on another
* thread is DoScan.
I found some more implementation information here. The feature is called AES.