McAfee Antivirus 7.0 Information check - KiXtart.org

You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Advanced Scripting » McAfee Antivirus 7.0 Information check

Page 1 of 2

Topic Options

#74307 - 2003-04-03 10:36 PM

McAfee Antivirus 7.0 Information check

Kdyer

KiX Supporter

Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR

With the release of McAfee Antivirus 7.0, we implemented a change in the Login Script..

CLS
 BREAK ON
 $mcafee='HKLM\SOFTWARE\McAfee\VirusScan'
 $tvd='HKLM\SOFTWARE\Network Associates\TVD'
 ;*************************************************************** 
 ; Determine Virus Product Version and retrieve variable settings 
 ;*************************************************************** 
 SELECT
 CASE
       ;NS403a 
       KEYEXIST('HKLM\SOFTWARE\Network Associates\NetShield NT')
       $datnum=SUBSTR(READVALUE($mcafee,'szVirDefVer'),5,4)
       $engine=READVALUE($mcafee,'szEngineVer')
       $product=READVALUE($mcafee,'szProductVer')
 CASE
       ;NS45 
       KEYEXIST($tvd+'\Netshield NT\CurrentVersion')
       $datnum=SUBSTR(READVALUE($tvd+'\Netshield NT\CurrentVersion','szVirDefVer'),5,4)
       $engine=READVALUE($tvd+'\Netshield NT\CurrentVersion','szEngineVer')
       $product=READVALUE($tvd+'\Netshield NT\CurrentVersion','szProductVer')
 CASE
       ;VS451 
       KEYEXIST($tvd+'\VirusScan')
       $datnum=SUBSTR(READVALUE($tvd+'\Shared Components\VirusScan Engine\4.0.xx','szDatVersion'),5,4)
       $engine=READVALUE($tvd+'\Shared Components\VirusScan Engine\4.0.xx','szEngineVer')
       $product=READVALUE($tvd+'\VirusScan','szCurrentVersionNumber')
 CASE
       ;VS70 - Works with 7.0 and 7.1 
       KEYEXIST($tvd+'\VirusScan Enterprise\CurrentVersion')
       $datnum=READVALUE($tvd+'\VirusScan Enterprise\CurrentVersion','szVirDefVer')
       $engine=READVALUE($tvd+'\Shared Components\VirusScan Engine\4.0.xx','szEngineVer')
       $product=READVALUE($tvd+'\VirusScan Enterprise\CurrentVersion','szProductVer')
 CASE
       1
 ENDSELECT

 ?'Product Version '+$Product
 ?'DAT Number '+$Datnum
 ?'Engine '+$engine

GET $K

Thanks,

Kent

[ 24. October 2003, 19:18: Message edited by: kdyer ]

_________________________
Utilize these resources:
UDFs (Full List)
KiXtart FAQ & How to's

Top

#74308 - 2003-04-07 11:45 PM

Re: McAfee Antivirus 7.0 Information check

painless Offline

Lurker

Registered: 2003-04-07
Posts: 4

On our servers with NetShield 4.5, the code as posted comes up with an empty product value. I changed the reg path as below, and it works OK. Just thought I would mention it if somebody wants to take a look.

code:

 CASE
       ;NS45
       KeyExist($hklms+'\Network Associates\TVD\Netshield NT\CurrentVersion')
       $datnum=SUBSTR(READVALUE($hklms+'\Network Associates\TVD\Netshield NT\CurrentVersion','szVirDefVer'),5,4)
       $engine=READVALUE($hklms+'\Network Associates\TVD\Netshield NT\CurrentVersion','szEngineVer')
       ;$product=READVALUE($hklms+'\Network Associates\TVD\VirusScan','szCurrentVersionNumber')
       $product=READVALUE($hklms+'\Network Associates\TVD\Netshield NT\CurrentVersion','szProductVer')

Top

#74309 - 2003-10-24 07:05 PM Re: McAfee Antivirus 7.0 Information check
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11628 Loc: CA	Kent, Can you review your code and update as required before I try to incorporate it into the Helpdesk script. Really nice if you could use PostPrep too.
Top

#74310 - 2003-10-24 07:20 PM Re: McAfee Antivirus 7.0 Information check
Kdyer Kdyer KiX Supporter Registered: 2001-01-03 Posts: 6241 Loc: Tigard, OR	Doc, Code is updated.. Thanks, Kent _________________________ Utilize these resources: UDFs (Full List) KiXtart FAQ & How to's
Top

#74311 - 2003-10-24 11:16 PM

Re: McAfee Antivirus 7.0 Information check

NTDOC

Administrator

Registered: 2000-07-28
Posts: 11628
Loc: CA

Kent,

Can you please try this code out and let me know if it works or not.

Painless,
If you're still around can you please test it as well.

debug off
break on
dim $iRC,$McAfeeInfo
$iRC=setoption('Explicit','on')
$iRC=setoption('NoVarsInStrings','on')
$iRC=setoption('WrapAtEOL','on')

$McAfeeInfo=GetMcAfeeVirusInfo()
?'Product Version '+$McAfeeInfo[0]
?'DAT Number '+$McAfeeInfo[1]
?'Engine '+$McAfeeInfo[2]

function GetMcAfeeVirusInfo()
dim $mcafee,$tvd,$datnum,$engine,$product,$McAfeeArray[3]
$mcafee='HKLM\SOFTWARE\McAfee\VirusScan'
$tvd='HKLM\SOFTWARE\Network Associates\TVD'
select
  case
    ;NS403a  
    keyexist('HKLM\SOFTWARE\Network Associates\NetShield NT')
    $datnum=substr(readvalue($mcafee,'szVirDefVer'),5,4)
    $engine=readvalue($mcafee,'szEngineVer')
    $product=readvalue($mcafee,'szProductVer')
  case
    ;NS45  
    keyexist($tvd+'\Netshield NT\CurrentVersion')
    $datnum=substr(readvalue($tvd+'\Netshield NT\CurrentVersion','szVirDefVer'),5,4)
    $engine=readvalue($tvd+'\Netshield NT\CurrentVersion','szEngineVer')
    $product=readvalue($tvd+'\Netshield NT\CurrentVersion','szProductVer')
  case
    ;VS451  
    keyexist($tvd+'\VirusScan')
    $datnum=substr(readvalue($tvd+'\Shared Components\VirusScan Engine\4.0.xx','szDatVersion'),5,4)
    $engine=readvalue($tvd+'\Shared Components\VirusScan Engine\4.0.xx','szEngineVer')
    $product=readvalue($tvd+'\VirusScan','szCurrentVersionNumber')
  case
    ;VS70 - Works with 7.0 and 7.1  
    keyexist($tvd+'\VirusScan Enterprise\CurrentVersion')
    $datnum=readvalue($tvd+'\VirusScan Enterprise\CurrentVersion','szVirDefVer')
    $engine=readvalue($tvd+'\Shared Components\VirusScan Engine\4.0.xx','szEngineVer')
    $product=readvalue($tvd+'\VirusScan Enterprise\CurrentVersion','szProductVer')
  case
    1
endselect
 $McAfeeArray[0]=$Product
 $McAfeeArray[1]=$Datnum
 $McAfeeArray[2]=$engine
 $GetMcAfeeVirusInfo=$McAfeeArray
endfunction

Top

#74312 - 2003-10-24 11:38 PM Re: McAfee Antivirus 7.0 Information check
Kdyer Kdyer KiX Supporter Registered: 2001-01-03 Posts: 6241 Loc: Tigard, OR	Works great! Kent _________________________ Utilize these resources: UDFs (Full List) KiXtart FAQ & How to's
Top

#74313 - 2003-10-26 02:42 AM

Re: McAfee Antivirus 7.0 Information check

Saleem Offline

Hey THIS is FUN

Registered: 2001-04-11
Posts: 280
Loc: UAE

For checking latest definition files i using this code

code:

 
$virusfile="\\server\share$\virusfile.txt"
   	$details=@userid+", "+@date+", " +@ipaddress1+",dat files are old"
	$datver=ReadValue("HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\VirusScan Enterprise\CurrentVersion","szVirDefVer")
	$read=Right ($datver,4)
	If Exist("c:\update.ini")=1
		Del "c:\update.ini"
	EndIf 
	Copy "\\server\updates$\update.ini" "c:\"
	$srvdat=ReadProfileString("c:\update.ini","SuperDat-IA32","DATVersion")
	If ($read<>$srvdat)
		$WRITE=(WriteProfileString($virusfile,"Dats_Old",@wksta,$details))
    		Shell "\\server\share$\virus.bat"
	EndIf

_________________________
“I’ll not change you unless you don’t have intention to change yourself” --H:Quran

Top

#74314 - 2003-10-26 07:21 AM Re: McAfee Antivirus 7.0 Information check
Kdyer Kdyer KiX Supporter Registered: 2001-01-03 Posts: 6241 Loc: Tigard, OR	As you may have noticed this covers a few versions of McAfee. While your code may work well with newer versions, this should cover the older ones too. Kent _________________________ Utilize these resources: UDFs (Full List) KiXtart FAQ & How to's
Top

#74315 - 2003-10-28 04:05 PM Re: McAfee Antivirus 7.0 Information check
painless painless Lurker Registered: 2003-04-07 Posts: 4	I tried it on our one last remaining NS 4.5 server, and it worked fine. We have upgraded everything else to VSE 7.0 or 7.1, and will upgrade the 4.5 soon. Didn't try it yet on 7.0 or 7.1 but it seems like everybody indicates it is OK.
Top

#74316 - 2003-10-29 09:57 PM Re: McAfee Antivirus 7.0 Information check
Anonymous Anonymous Unregistered	Hello All KiXtart Members, I just want to say that they are both excellent scripts and thank you for the excellent post. Thanks, John [ 29. October 2003, 21:58: Message edited by: javong ]
Top

#74317 - 2004-02-18 03:27 PM Re: McAfee Antivirus 7.0 Information check
Boggi Boggi Lurker Registered: 2004-02-18 Posts: 3	McAfee Antivirus 7.0 Information check Hi, sorry to bother.... But I'd be very glad if you could posiblly help me You had a script regarding to McAfee antivirus version, so I'd like the same but using it for Sophos Antivirus and I'm new to scripts, so would you PLEASE tell me word what this means $tvd -> keyexist('HKLM\SOFTWARE\Network Associates\NetShield NT'), then you have $datnum -> $datnum=substr(readvalue($mcafee, ($mcafee,'szVirDefVer'),5,4) and so on taken from your script keyexist('HKLM\SOFTWARE\Network Associates\NetShield NT') $datnum=substr(readvalue($mcafee,'szVirDefVer'),5,4) $engine=readvalue($mcafee,'szEngineVer') $product=readvalue($mcafee,'szProductVer') Thank you very very much in advance Boggi
Top

#74318 - 2004-02-18 04:30 PM Re: McAfee Antivirus 7.0 Information check
Sealeopard Sealeopard KiX Master Registered: 2001-04-25 Posts: 11165 Loc: Boston, MA, USA	See the KiXtart Manual for detailed explanations of KiXtart functions/commands. KEYEXIST checks for the prsence of a registry key. The SUBSTR retrieves a portion of a string that is stored in the referenced registry value read by READVALUE. The code is specific to McAfee! _________________________ There are two types of vessels, submarines and targets.
Top

#74319 - 2004-02-18 10:47 PM Re: McAfee Antivirus 7.0 Information check
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11628 Loc: CA	I'd be glad to help but you may have to wait for a bit. I plan to write one for a couple other AV products, just not sure when. I need them for another KiXforms project I'm working on. However, time to do these scripts at home has recently been highly curtailed so will have to do them as I have time.
Top

#74320 - 2004-02-19 05:44 AM Re: McAfee Antivirus 7.0 Information check
Kdyer Kdyer KiX Supporter Registered: 2001-01-03 Posts: 6241 Loc: Tigard, OR	We do not have Sophos in the Enterprise.. Sorry. Kent _________________________ Utilize these resources: UDFs (Full List) KiXtart FAQ & How to's
Top

#74321 - 2004-02-20 12:20 AM Re: McAfee Antivirus 7.0 Information check
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11628 Loc: CA	Well does anyone have a valid link to download the Sophos AV software? I don't care to fill out there form with real or bogus information at this time. I can if I really have to, but would be nice if someone had a link to directly download a demo This link wants you to fill out a form http://www.sophos.com/products/sav/eval/
Top

#74322 - 2004-02-20 12:47 AM Re: McAfee Antivirus 7.0 Information check
Kdyer Kdyer KiX Supporter Registered: 2001-01-03 Posts: 6241 Loc: Tigard, OR	Rather than downloading the whole deal, why not dig around the following doc - http://www2.essex.ac.uk/cs/virus/usage/nt_men.pdf ? Kent _________________________ Utilize these resources: UDFs (Full List) KiXtart FAQ & How to's
Top

#74323 - 2004-02-20 12:56 AM Re: McAfee Antivirus 7.0 Information check
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11628 Loc: CA	Thanks for the link and idea. The manual has little info to make this easy. I need to either get valid data keys and files to check against or I need to install the program. I'll wait a day or so and if no one else supplies info or demo link I'll fill out there stupid form with bogus info. You'd think some of these Web sites would get tired of pouring through bogus info and just provide a stupid link.
Top

#74324 - 2004-02-20 03:06 AM Re: McAfee Antivirus 7.0 Information check
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11628 Loc: CA	Well this site should be able to locate the file as well http://www.filemirrors.com/ Look for angz.exe
Top

#74325 - 2005-02-23 08:28 PM

Re: McAfee Antivirus 7.0 Information check

NTDOC

Administrator

Registered: 2000-07-28
Posts: 11628
Loc: CA

Well, since I've had a request for a stand alone McAfee script that would work during logon for normal users, here is a modified version of the one from the SIM KiXform project.

Let me know if it doesn't work correctly as I don't have McAfee installed to test at the moment.

Code updated, thanks Kent

Break On

Dim $SO,$McAfeeInfo,$Pause

$SO=SetOption('Explicit','On')

$SO=SetOption('NoVarsInStrings','On')

$SO=SetOption('WrapAtEOL','On')

 

$McAfeeInfo=GetMcAfeeAV()

If VarType($McAfeeInfo)<>8

  ?'Product Version '+$McAfeeInfo[0]

  ?'DAT Number '+$McAfeeInfo[1]

  ?'Engine '+$McAfeeInfo[2]

  ?'Product ' + $McAfeeInfo[3]

  ?'ePO ' + $McAfeeInfo[4]

Else

  ?'McAfee AV not detected...'

EndIf 

Color 'r/w'

?? 'Completed.  Press a key to continue...'

Get $Pause

 

Function GetMcAfeeAV()

  Dim $AVMcafee,$Tvd,$PName,$DatNum,$AVEngine,$Product,$Key,$ePO

  $AVMcafee = 'HKLM\SOFTWARE\McAfee\VirusScan'

  $Tvd = 'HKLM\SOFTWARE\Network Associates\TVD'

  $Key = 'HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent'

  $ePO = KeyExist($Key)

  If $ePO

    $Key = 'HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\EPOAGENT3000'

    $ePO = ReadValue($Key, 'Version')

    If Not $ePO $ePO='Unknown' EndIf

  Else

    $ePO =""

  EndIf

  Select

    Case KeyExist($Tvd+'\VirusScan Enterprise\CurrentVersion')

      ; VS70 - Works with 7.0, 7.1, 8.0  

      $PName = 'VirusScan Enterprise'

      $DatNum = 'DAT File Version: ' + ReadValue($Tvd+'\VirusScan Enterprise\CurrentVersion',
'szVirDefVer')

      $AVEngine = 'Engine Version: ' + ReadValue($Tvd+'\Shared Components\VirusScan 
Engine\4.0.xx','szEngineVer')

      $Product = 'Product Version: ' + ReadValue($Tvd+'\VirusScan Enterprise\CurrentVersion',
'szProductVer')

    Case KeyExist($Tvd+'\VirusScan')

      ; VS451  

      $PName = 'VirusScan 4.51'

      $Datnum = 'DAT File Version:=' + SubStr(ReadValue($Tvd+'\Shared Components\VirusScan 
Engine\4.0.xx','szDatVersion'),5,4)

      $AVEngine = 'Engine Version:=' + ReadValue($Tvd+'\Shared Components\VirusScan 
Engine\4.0.xx','szEngineVer')

      $Product = 'Product Version:=' + ReadValue($Tvd+'\VirusScan','szCurrentVersionNumber')

    Case KeyExist($Tvd+'\Netshield NT\CurrentVersion')

      ; NS45  

      $PName = 'NetShield NT 4.5'

      $Datnum = 'DAT File Version:=' + SubStr(ReadValue($Tvd+'\Netshield NT\CurrentVersion',
'szVirDefVer'),5,4)

      $AVEngine = 'Engine Version:=' + ReadValue($Tvd+'\Netshield NT\CurrentVersion','szEngineVer')

      $Product = 'Product Version:=' + ReadValue($Tvd+'\Netshield NT\CurrentVersion','szProductVer')

    Case KeyExist('HKLM\SOFTWARE\Network Associates\NetShield NT')

      ; NS403a  

      $PName = 'NetShield NT 4.03a'

      $Datnum = 'DAT File Version:=' + SubStr(ReadValue($AVMcafee,'szVirDefVer'),5,4)

      $AVEngine = 'Engine Version:=' + ReadValue($AVMcafee,'szEngineVer')

      $Product = 'Product Version:=' + ReadValue($AVMcafee,'szProductVer')

  EndSelect

  $GetMcAfeeAV = $PName,$DatNum,$AVEngine,$Product,$ePO

EndFunction

Edited by NTDOC (2005-02-24 08:01 PM)

Top

#74326 - 2005-02-24 07:03 PM Re: McAfee Antivirus 7.0 Information check
Kdyer Kdyer KiX Supporter Registered: 2001-01-03 Posts: 6241 Loc: Tigard, OR	PostPrep is not able to post where you don't have to re-format in Word or something like that. Changed: $McAfeeInfo=GetMcAfeeVirusInfo To: $McAfeeInfo=GetMcAfeeAV() Other than that, it works great. Product Version VirusScan Enterprise DAT Number DAT File Version: 4.0.4432 Engine Engine Version: 4.4.00 Product Product Version: 8.0.0.912 ePO 3.1.2.257 Thanks Doc! Thanks, Kent _________________________ Utilize these resources: UDFs (Full List) KiXtart FAQ & How to's
Top

Page 1 of 2

Previous Topic View All Topics

Index Next Topic

Moderator: Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart

Hop to:

Shout Box

Search the board with:
superb Board Search
or try with google:

	Web kixtart.org