How does SP2 detect Virus software?

[flakzeus]

As the title indicates, how does Windows XP SP2 detect Anti-Virus Software?

Is there a registry key or flat file that stores this information?

Thanks.

[vidster]

That's a good one flakzeus
Why would you want to know, if i might ask

[cata34]

Originally Posted by vidster

That's a good one flakzeus
Why would you want to know, if i might ask

I am interested too in a answer to this question... Just becouse I want to know if SP2 is more efficient than other Anti-Virus Software.... I think it is a good point!

[vidster]

Originally Posted by cata34

I am interested too in a answer to this question... Just becouse I want to know if SP2 is more efficient than other Anti-Virus Software.... I think it is a good point!

Please do not be fooled in to thinking that sp2 is in any way an antivirus program
sp2 fixed a whole bunch of security exploits, installed the Windows Security Centre and made the Windows Firewall more accessible. sp2 will monitor your system and tell you about any vital updates you need to install. It will also tell you that your computer is at risk if you do not have any antivirus software running.
The Firewall is a good thing but it is by no means the best you can use.

I would recommend using AVG7 antivirus and Sygate Personal Firewall as a bare minimum where security is concerned

PS. Both programs are free

[flakzeus]

Reason: I want to know this so that I am developing a script that will install an anti-virus solution if one is not present. I would like to know where Windows stores this information so that I am too, know if they (the user) have protection.

Personally, I like the ClamWin project which provides free anti-virus. However, it does not have a "on access" scanner at the moment.

[vidster]

Ahh.....Good idea
How are you going to determine what antivirus solution should be used? (i know nothing about writing scripts by the way)

[flakzeus]

The company that I work for is licensed for McAffe Enterprise.

[vidster]

You'll be using AVG then
Only joking
It's a good idea! I hope you do well with it.

[sp_100]

http://www.theregister.co.uk/2004/09...curity_review/

http://www.microsoft.com/technet/pro.../sp2mempr.mspx

There is NO antivirus in SP2.

[Cache]

Originally Posted by sp_100

http://www.theregister.co.uk/2004/09...curity_review/

http://www.microsoft.com/technet/pro.../sp2mempr.mspx

There is NO antivirus in SP2.

I belive the question he is aking is/or should be: "how does Windows XP SP2 detect ANTIVirus Software?"

[flakzeus]

Originally Posted by cache

I belive the question he is aking is/or should be: "how does Windows XP SP2 detect ANTIVirus Software?"

You sir, are correct.

[Cache]

I think this question would be better asked in the MSDN forum:

http://forums.microsoft.com/msdn/default.aspx

[Cache]

Originally Posted by sp_100

http://www.theregister.co.uk/2004/09...curity_review/

http://www.microsoft.com/technet/pro.../sp2mempr.mspx

There is NO antivirus in SP2.

Actually I just thought, its a good job you made the above post. It will help people with the same way of thinking as the 3rd post down realize SP2 is not the only line of security needed. I didnt realize people thought SP2 has a Antivirus.

[flakzeus]

Thanks for the idea but I'm not getting an answer there either

After a little searching I found this from Microsoft:

Q: How does Windows Security Center detect third-party products and their status?
A: Windows Security Center uses a two-tiered approach for detection status. One tier is manual, and the other tier is automatic through Windows Management Instrumentation (WMI). In manual detection mode, Windows Security Center searches for registry keys and files that are provided to Microsoft by independent software manufacturers. These registry keys and files let Windows Security Center detect the status of independent software. In WMI mode, software manufacturers determine their own product status and report that status back to Windows Security Center through a WMI provider. In both modes, Windows Security Center tries to determine whether the following is true:
• An antivirus program is present.
• The antivirus signatures are up-to-date.
• Real-time scanning or on-access scanning is turned on for antivirus programs.
• For firewalls, Windows Security Center detects whether a third-party firewall is installed and whether the firewall is turned on or not.

Where this is a start, but still does not tell me where the information is stored.

[flakzeus]

Originally Posted by flakzeus

Thanks for the idea but I'm not getting an answer there either

After a little searching I found this from Microsoft:




Where this is a start, but still does not tell me where the information is stored.

So in case you guys are interested, I found a way to use COM objects to access the WMI database that stores this information. And the best part is, I did this in PHP! hehe. Thanks for your input guys.