3

Possible Duplicates:
Detect Antivirus on Windows using C#
How to detect if a virusscanner and/or firewall is installed? (And a few other security-related Q's.)

is there a way to detect currently instaled av without searching for known processes?

Community
  • 1
  • 1
opc0de
  • 11,557
  • 14
  • 94
  • 187
  • 8
    You could try to download a virus – gooddadmike Oct 18 '10 at 20:05
  • 1
    For Windows (XP SP 2 or later): I'm guessing there might be a registry key somewhere that Windows uses to determine if you have *any* AV installed or not. I'm basing this on the fact that Windows always seems to know if an anti-virus is installed, and which one. – FrustratedWithFormsDesigner Oct 18 '10 at 20:09
  • 4
    What the heck are you building?!!@? (this comment is in reference to your rather shady list of questions asked thus far, just today). – Chris Thornton Oct 18 '10 at 20:56

2 Answers2

5

Yes there is. You can use WMI, I assume you are asking about Windows, to check installed instances of an anti-virus program. It is quite simple from C# and this link gives a good explanation of how to do it. It is also possible to access WMI from C++ and that is explained here. Also for anything WMI related I highly recommend the WMI Studio.

linuxuser27
  • 7,183
  • 1
  • 26
  • 22
  • Beat me by 5 seconds! :) – Mark Allen Oct 18 '10 at 20:11
  • There is one problem with WMI tho. Anybody can write there anything. This is often misused by viruses (fake AVs). So in the end you still need list of known "AVs". – Kra Oct 18 '10 at 20:26
  • 2
    @Kra Well sure, but at that point all bets are off. You really can't know for sure. You can't even reliably detect, necessarily, whether you are running in a VM. We might be in a VM right now... (j/k) – Mark Allen Oct 18 '10 at 21:03
  • 1
    Example for the WMI: Run this from PowerShell: `Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct` – zvi Mar 07 '17 at 14:29
2

It depends on the AV software and the OS but it looks like you can use WMI. Here's an example on using WMI script - using WMI from C++ is outside of my knowledge, sorry.

http://web.archive.org/web/20130127234041/http://blogs.msdn.com/b/alejacma/archive/2008/05/12/how-to-get-antivirus-information-with-wmi-vbscript.aspx

Govind Parmar
  • 20,656
  • 7
  • 53
  • 85
Mark Allen
  • 1,230
  • 1
  • 15
  • 17