Can we control if DAT is current via program or script?

[polecat]

We have a small customer who uses Enterprise Virus Scan vse8.7i but no ePO. He is working closely with a bank, exchanging data and information through the net. This bank now wants to make sure that the virus scanner is current before they allow the connection. They use Symantec EPP, which obviously has a way to programmatically check if all scanners are current. They asked us now, if McAfee can do the same. I have not found anything and would be grateful for ideas or links.

Thanks

[wwarren]

You can inspect the Application Event log.

Source = McLogEvent

ID = 5000

It contains the information you're looking for about what DAT and Engine version is in use by the product. This method provides reliable information.

It's not reliable to use the registry.

[Tristan]

There are two registry locations that do store the DAT version if you do want to go down that route.

HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800\DATVersion

and

HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine\AVDatVersion

And ones that might also be of use are

HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800\DATDate

or

HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800\DATInstallDate

As wwarren suggests these aren't 100% reliable.

Another option might be to check the modified dates on the engine files located in C:\Program Files\Common Files\McAfee\Engine

avvscan.dat, avvnames.dat & avvclean.dat

[polecat]

Thanks for the answers, they will help us.

Cheers