RE: Antivirus listing

"Debasis Mohanty" <[email protected]> Sat, 12 Feb 2005 00:09:12 +0530
Newsgroups gmane.comp.security.programming
Message-ID <[email protected]>
There are many ways that you can achieve it. I doubt if there is any =
single
API (correct me if I am wrong) which can enumerates all the installed =
AVs.
Most of the cases an AV will prompt you to un-install previously =
installed
AVs before installing. One such classic example is Symantec and McAfee, =
both
are mutually exclusive ;). But in your case assuming that you have more =
than
one AV, there are many ways you can enumerate the list of AVs installed.
Find below various possible ways:=20

First you need to create a list of various entries being made by the AV =
in
the system when they gets installed. i.e. entries in the registry, =
service
control manager, local folders etc etc...=20

Then you can follow either of the below given options -=20

1.	Enumerating Services and Searching for those entries
	Use APIs like "OpenSCManager" and "EnumServicesStatus"

2.	Enumerating Registry Keys and searching for those entries
	Look for Installed Avs here "HKLM\Software" .=20
	Use APIs like "RegEnumKey"

3.	Enumerating Browser Helper Objects and look for those entries

4.	Enumerating Running Services=20
	"EnumWindows" or "Toolhelp32Snapshot"

5. 	Looking for Installed Components and look for those entries
	Use "FindFirstFile" or "FindFile"=09

And there are many more like this but all of them are more or less same. =
It
all depends which one you choose. In my opinion, option 1 and 2 are =
better
ideas.=20

Refer MSDN incase you need to have more ideas about the above APIs.=20


Regards,=20
Debasis Mohanty
www.hackingspirits.com =20

-----Original Message-----
From: weninson r=EAgo [mailto:[email protected]]=20
Sent: Friday, February 11, 2005 6:14 PM
To: [email protected]
Subject: Antivirus listing

Hi,

   I dont know if this is the right list to send this but.
   Anyone know if there is an API to list the antivirus that are =
installed
in a windows machine and retrieve if the antivirus is up to date? Or any =
way
to retrieve these informations, i need to do a program to acomplish =
these
tasks.
   I've searched all sites but got none yet. Only OPSWAT SDK but it is a
payd SDK.


Thanks in advance

--
Lassen Sie Ihren Gedanken freien Lauf... z.B. per FreeSMS GMX bietet bis =
zu
100 FreeSMS/Monat: http://www.gmx.net/de/go/mail