检查C＃中的防病毒状态

Question

我需要检查一组服务器以查看防病毒是否是最新的并且正在运行。棘手的事情是，他们分布在Windows 2003和2008服务器，我需要能够检查所有。

有没有办法用C＃或VB.NET做到这一点？

我已经使用WMI进行了简要介绍，但它出现在2008/win7计算机上，微软已经改变了他们给你的信息。

总之，我需要如下：

• AV名
• AV版
• AV跟上时代的
• 启用AV /运行

谁能帮助？

Answer 1

如您所述，可以使用WMI找到here。海报声明这是在Win 7机器上完成的;所以下面的代码应该让你开始...

ConnectionOptions _connectionOptions = new ConnectionOptions(); 
//Not required while checking it in local machine. 
//For remote machines you need to provide the credentials 
//options.Username = ""; 
//options.Password = ""; 
_connectionOptions.EnablePrivileges = true; 
_connectionOptions.Impersonation = ImpersonationLevel.Impersonate; 
//Connecting to SecurityCenter2 node for querying security details 
ManagementScope _managementScope = new ManagementScope(string.Format("\\\\{0}\\root\\SecurityCenter2", ipAddress), _connectionOptions); 
_managementScope.Connect(); 
//Querying 
ObjectQuery _objectQuery = new ObjectQuery("SELECT * FROM AntivirusProduct"); 
ManagementObjectSearcher _managementObjectSearcher = 
    new ManagementObjectSearcher(_managementScope, _objectQuery); 
ManagementObjectCollection _managementObjectCollection = _managementObjectSearcher.Get(); 
if (_managementObjectCollection.Count > 0) 
{ 
    foreach (ManagementObject item in _managementObjectCollection) 
    { 
     Console.WriteLine(item["displayName"]); 
     //For Kaspersky AntiVirus, I am getting a null reference here. 
     //Console.WriteLine(item["productUptoDate"]); 

     //If the value of ProductState is 266240 or 262144, its an updated one. 
     Console.WriteLine(item["productState"]); 
    } 
} 

Answer 2

根据您的环境设置，您可能需要指定您的安全和权限。您还应该注意，某些防病毒产品（如McAfee）不会通过WMI提供数据。

您可以使用WMI这个片段查询杀毒软件信息：

string computer = Environment.MachineName; 
string wmipath = @"\\" + computer + @"\root\SecurityCenter"; 
string query = @"SELECT * FROM AntivirusProduct"; 

ManagementObjectSearcher searcher = new ManagementObjectSearcher(wmipath, query); 
ManagementObjectCollection results = searcher.Get(); 

foreach (ManagementObject result in results) 
{ 
    // do something with `result[value]`); 
}