detect antivirus on remote machine

[marcvs]

Hi All!

I'm playing around with WMI to get information about remote machines on a network such as running processes, installed applications, etc.

I would like to know if an antivirus is installed and some info about it such as if it is currently running, or if its definitions are up to date.

I noticed that if you disable your antivirus, Windows will warn you that "your computer might be at risk. xyz antivirus version x.xx is turned off." (this is a balloon that appears in the system tray over Windows Security Alerts). So I was thinking antivirus programs have some special way of 'registering' themselves. Is this so? Can I access this information?

Thanks in advance

 

[marcvs]

There has to be a way to do this... Everest (a great tool that collects loads of info about your machine) detects the antivirus you have installed (on the local machine), its version and database date in its security section.