Capturing Symntec's Antivirus event

[adam.amitai]

Hello I am tring to capture a Symantec Antivirus "Virus found" event
using WMI. Any idea????

 

[Joseph]

Use a 'Real' anti-virus to start with.

 

[timothyasir]

Try with the following code.
If you have any doubts ask me!

strComputer = "."

On Error Resume Next
Set oWMI = GetObject _
("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer _
& "\root\SecurityCenter")

Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")

If Err = 0 Then
For Each objAntiVirusProduct In colItems
WScript.Echo "companyName: " & objAntiVirusProduct.companyName
WScript.Echo "displayName: " & objAntiVirusProduct.displayName
WScript.Echo "enableOnAccessUIMd5Hash: " _
& objAntiVirusProduct.enableOnAccessUIMd5Hash
WScript.Echo "enableOnAccessUIParameters: " _
& objAntiVirusProduct.enableOnAccessUIParameters
WScript.Echo "instanceGuid: " & objAntiVirusProduct.instanceGuid
WScript.Echo "onAccessScanningEnabled: " _
& objAntiVirusProduct.onAccessScanningEnabled
WScript.Echo "pathToEnableOnAccessUI: " _
& objAntiVirusProduct.pathToEnableOnAccessUI
WScript.Echo "pathToUpdateUI: " & objAntiVirusProduct.pathToUpdateUI
WScript.Echo "productUptoDate: " & objAntiVirusProduct.productUptoDate
WScript.Echo "updateUIMd5Hash: " & objAntiVirusProduct.updateUIMd5Hash
WScript.Echo "updateUIParameters: " _
& objAntiVirusProduct.updateUIParameters
WScript.Echo "versionNumber: " & objAntiVirusProduct.versionNumber
Next
Else
Err.Clear
WScript.Echo "Unable to connect to SecurityCenter class on " _
& strComputer & "."
WScript.Echo " Error Number:" & Err.Number
WScript.Echo " Source:" & Err.Source
WScript.Echo " Description:" & Err.Description
End If



Regards,
Tim
Mindteck (India) Pvt. Ltd

 

[timothyasir]

The above code for finding any virus scanner installed in your system. (Generic)

Regards,
Timothy Asir .J
Mindteck (India) Pvt. Ltd