How to detect if a virusscanner and/or firewall is installed? (And a few other security-related Q's.)

Question

I have an application and I\'m trying to make sure it\'s running in a secure environment. First of all, I check if Windows is genuine, which makes it more likely that the us

Answer 1

I think you can do most of this via WMI

Something like this:

ManagementObjectSearcher wmiData = new ManagementObjectSearcher(@"root\SecurityCenter", "SELECT * FROM AntiVirusProduct");
ManagementObjectCollection data = wmiData.Get();

foreach (ManagementObject virusChecker in data)
{
    // This is the virus checkers name.
    String virusCheckerName = virusChecker["displayName"];
}

_{[You didn't mention what language, so the sample above is in C#, but WMI can be done from pretty much anything]}

[Edit: You can do the same but with "FirewallProduct" instead for firewall info. Also, for the anti virus, you can look at the "productUptoDate" property on the results for info on if it's up to date]

The WMI reference should help you find the others. (1, 2, 3, and 4 I'm pretty certain are available through WMI. 5 I'm not so certain about, but I think it probably should be)

You'll probably find WMI Code Creator helpful for testing and figuring out what queries/objects you need to use. Also Scriptomatic and WMI Admin tools might be useful.