Detecting What Anti-Virus is installed or Running

Is there any way to detect the Anti-Virus program running? I have a dll that
gives a false positive on certain anti-virus programs and I would like to be
able to warn people BEFORE I install.. because the antivirus program (Trend
Micro) in this case instantly deletes the dll. I have the problem solved
temporarily because the 3rd party dll was fixed. But, I suspect this will
happen in the future as anti-virus programs get more aggressive and it would
be nice to have that capability when I need it.

Thanks,

--
Ray Rippey
VMT Software - http://www.vmtsoft.com

Ray,

> Is there any way to detect the Anti-Virus program running? I have a dll
> that gives a false positive on certain anti-virus programs and I would
> like to be able to warn people BEFORE I install.. because the antivirus
> program (Trend Micro) in this case instantly deletes the dll. I have the
> problem solved temporarily because the 3rd party dll was fixed. But, I
> suspect this will happen in the future as anti-virus programs get more
> aggressive and it would be nice to have that capability when I need it.

What you can try to do is to "scan" through the Windows Registry to find
installed anti-virus products. All installed products are registered under
the following key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall

You can very easily enumerate "subkeys" and "subvalues" with SetupBuilder
(see "Get Registry SubKey...", etc. script functions) to find specific
anti-virus products.

See attached 'quick-and-dirty' screenshot and .sb7 project example to detect
"avast!".

The same method can be used to detect other anti-virus or anti-spyware
products.

Friedrich

Now that's impressive! Tried talking to Trend about the situation, maybe
get a test virus program.. we got transferred from India, to the states,
then back to India I think. A complete waste of time. Fortunately I have
customer that's a reseller of Trend so I'll buy one cheap so I can test
it... and then I can test my install to detect it.. perfect.

Thanks,

Ray
VMT