檢查C＃中的防病毒狀態

Question

我需要檢查一組服務器以查看防病毒是否是最新的並且正在運行。棘手的事情是，他們分佈在Windows 2003和2008服務器，我需要能夠檢查所有。

有沒有辦法用C＃或VB.NET做到這一點？

我已經使用WMI進行了簡要介紹，但它出現在2008/win7計算機上，微軟已經改變了他們給你的信息。

總之，我需要如下：

• AV名
• AV版
• AV跟上時代的
• 啓用AV /運行

誰能幫助？

Answer 1

如您所述，可以使用WMI找到here。海報聲明這是在Win 7機器上完成的;所以下面的代碼應該讓你開始...

ConnectionOptions _connectionOptions = new ConnectionOptions(); 
//Not required while checking it in local machine. 
//For remote machines you need to provide the credentials 
//options.Username = ""; 
//options.Password = ""; 
_connectionOptions.EnablePrivileges = true; 
_connectionOptions.Impersonation = ImpersonationLevel.Impersonate; 
//Connecting to SecurityCenter2 node for querying security details 
ManagementScope _managementScope = new ManagementScope(string.Format("\\\\{0}\\root\\SecurityCenter2", ipAddress), _connectionOptions); 
_managementScope.Connect(); 
//Querying 
ObjectQuery _objectQuery = new ObjectQuery("SELECT * FROM AntivirusProduct"); 
ManagementObjectSearcher _managementObjectSearcher = 
    new ManagementObjectSearcher(_managementScope, _objectQuery); 
ManagementObjectCollection _managementObjectCollection = _managementObjectSearcher.Get(); 
if (_managementObjectCollection.Count > 0) 
{ 
    foreach (ManagementObject item in _managementObjectCollection) 
    { 
     Console.WriteLine(item["displayName"]); 
     //For Kaspersky AntiVirus, I am getting a null reference here. 
     //Console.WriteLine(item["productUptoDate"]); 

     //If the value of ProductState is 266240 or 262144, its an updated one. 
     Console.WriteLine(item["productState"]); 
    } 
} 

Answer 2

根據您的環境設置，您可能需要指定您的安全和權限。您還應該注意，某些防病毒產品（如McAfee）不會通過WMI提供數據。

您可以使用WMI這個片段查詢殺毒軟件信息：

string computer = Environment.MachineName; 
string wmipath = @"\\" + computer + @"\root\SecurityCenter"; 
string query = @"SELECT * FROM AntivirusProduct"; 

ManagementObjectSearcher searcher = new ManagementObjectSearcher(wmipath, query); 
ManagementObjectCollection results = searcher.Get(); 

foreach (ManagementObject result in results) 
{ 
    // do something with `result[value]`); 
}