#[SAMPLE]
#Name=Product Descriptive Name
#DETECT=Detection method, same rule as DESC1, but returns true/false
#SERVICE=name of Windows service, returns true/false based on service running status
#DESC1=Type;Data;Item,Return
#  Type is one of "REG", "FILEX", "FILEV", or "WMI"
#  Data defines what to read
#  Item is the specific item to read
#  Return is one of "bool" or "value" (default if none specified). Bool returns T/F if the item exists AND value is not null
#  DESC1 is a description of the value - it is returned to the calling routine with the value

[MCAFEE]
Name=McAfee Anti Virus
# Registry read, specify key and value, return boolean value if key-value is defined
Detect=REG;HKLM\SOFTWARE\Network Associates\TVD\Shared Components\VirusScan Engine\4.0.xx;DAT,bool
Service=McShield
Product Name=REG;HKLM\SOFTWARE\Network Associates\TVD\VirusScan Enterprise\CurrentVersion;Product;Value
Product Version=REG;HKLM\SOFTWARE\Network Associates\TVD\VirusScan Enterprise\CurrentVersion;szProductVer;Value
# Check two locations for a value, only check second if first is null
Engine Version=REG;HKLM\SOFTWARE\Network Associates\TVD\VirusScan Enterprise\CurrentVersion|HKLM\SOFTWARE\Network Associates\TVD\Shared Components\VirusScan Engine\4.o.xx;szEngineVersion;Value
Database Version=REG;HKLM\SOFTWARE\Network Associates\TVD\VirusScan Enterprise\CurrentVersion|HKLM\SOFTWARE\Network Associates\TVD\Shared Components\VirusScan Engine\4.o.xx;szVirDefVer;Value
Database Date=REG;HKLM\SOFTWARE\Network Associates\TVD\VirusScan Enterprise\CurrentVersion|HKLM\SOFTWARE\Network Associates\TVD\Shared Components\VirusScan Engine\4.o.xx;szVerDefDate;Value
EPolicy Director=REG;HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent;Installed Path;Bool:Installed


#[NORTON]
#Name=Norton Anti Virus
#
#[SYMANTECN]
#Name=Symantec Norton AntiVirus Version
#
#[SYMANTEC]
#Name=Symantec Anti Virus Corporate Edition
#
#[BITDEF]
#Name=BitDefender
#
#[KASLAB]
#Name=Kaspersky Anti-Virus
#
#[NOD32]
#Name=NOD32 Antivirus System
#
#[PANDA]
#Name=Panda Antivirus 
#
#[TREND]
#Name=Trend Micro Anti Virus
#
#[WINLIVE]
#Name=Windows Live OneCare AntiVirus
