SMS check the Mcafee DAT & Scan engine version

[chongtl]

May I know how can I query the version of Mcafee DAT & Scan Engine?

Thanks in advance.

 

[tbrennans]

http://www.myitforum.com/articles/1/view.asp?id=4324

 

[tbrennans]

actually this is more to the point..you will need to modify the sms_def.mof to read the reg key

http://www.myitforum.com/articles/1/view.asp?id=3461

 

[Mich]

OK, I tried to do this, but kept running into a wall. I'll show you how far I got and hopefully you can finish the job.

First, I found the reg keys that contain that information. They are as follows:

local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan Enterprise\\CurrentVersion|szProductVer

local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szVirDefVer

local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szEngineVer

local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szVirDefDate

The next thing I did was modify my sms_def to populate my WMI. I added the following text to the sms_def.mof:

//-----------------------------
//McAfee definition files
//-----------------------------


#pragma namespace("\\\\.\\root\\cimv2")

#pragma deleteclass("McAfee", NOFAIL)

[DYNPROPS]
class McAfee
{
[key] string KeyName="";
string szProductVer;
string szVirDefVer;
string szEngineVer;
string szVirDefDate;
};

////////
// Declare the instance
////////

[DYNPROPS]
instance of McAfee
{
KeyName="McAfee";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\VirusScan Enterprise\\CurrentVersion|szProductVer"),
Dynamic, Provider("RegPropProv")] szProductVer;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szVirDefVer"),
Dynamic, Provider("RegPropProv")] szVirDefVer;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szEngineVer"),
Dynamic, Provider("RegPropProv")] szEngineVer;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Network Associates\\TVD\\Shared Components\\VirusScan Engine\\4.0.xx|szVirDefDate"),
Dynamic, Provider("RegPropProv")] szVirDefDate;
};


////////
// Change to the CIMV2\SMS Namespace and declare the Reporting Class
////////

#pragma namespace("\\\\.\\root\\cimv2\\SMS")

[SMS_Report(TRUE),
SMS_Group_Name("McAfee Virus Scan"),
SMS_Class_ID("MICROSOFT|McAfee|1.0")]
class McAfee : SMS_Class_Template
{
[SMS_Report(TRUE),key]
string KeyName;
[SMS_Report(TRUE)]
string szProductVer;
[SMS_Report(TRUE)]
string szVirDefVer;
[SMS_Report(TRUE)]
string szEngineVer;
[SMS_Report(TRUE)]
string szVirDefDate;
};

Here is where you take over

This populates my WMI, but I couldn't figure out (not enough time) how to get that information into one of the SMS SQL tables.

To get around this I did a software inventory of \\local\\program files\common files\network associates\engine\clean.dat. This won't tell you the version, but you can run a check of the modified date to see the last update.

HTH.