Check for sophos and wpkg

[ifm]

I'm new to Lansweeper and to SQL, so the guide didnt say much to me.

Anyone know how to make a script that make an alarm if Sophos and WPKG is not installed. (one alarm for each)
It should work the same way that the included Fsecure-script does but for Sophos and WPKG instead.
Will probably be able to use the data from scanned installed software(?)

[sundarrs]

Hello Tom999,

Can you please help me to generate a report for

Mcafee DATVersion , Mcafee DATDate

Kindly help me with a script

Regards,

Sundar R S

[tom999]

Hi,

I would really like to be able to see both who has Mcafee AV enterprise installed (which I think I can work out based on checking for the program as above) but also what DAT (AV signature update) version they are on.

The reg keys are:

Under:
HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine

Key AVDatVersion Type Reg_Dword
The key is hexidecimal but when switched to decimal it shows the current Dat version

Key AVDatVersionMinor
Minor dat key

The dat key is reported in the software as xxx.xxxx datversion.minordatversion

AVDatDate Reg_SZ
Shows the update date in the format 2009/05/28

Seeing the update date and dat version would be great. Also being able to see anyone in the summary below the highest dat number recorded or over a week behind the current date for example would be fantastic.

Happy to help test in any way I can

thanks

Tom

[Hemoco]

Niles,

Please post the registry key and I'll see if I can help you.

[Pollak]

Nothing so far to report the version of Mcafee. Scanning the files does not report the version of the dat files or the engine. I am able to find this in the registry, but see no way to create a report to do so. Please help. Plus I see no way to delete a report from ReportBuilder.



Thanks,
Niles

[Hemoco]

Add to the query

and computername in (select computername from tbloperatingsystem)

[ifm]

New question.
When I check my software report I get the same computers listed which does not yet have been fully scanned as computers without Sophos.
How can I add to this report, so only computers that HAVE been scanned and does not have Sophos installed show up in the report?

[ifm]

I made it! 🙂
Copy paste is the shit... you may include this in the next release.
Here is a working report for Sophos Anti-Virus:

SELECT
tblcomputers.computername
FROM
tblcomputers
WHERE
computername NOT IN (SELECT dbo.tblSoftware.ComputerName FROM dbo.tblSoftware WHERE softwareName LIKE 'Sophos Anti-Virus') AND
computername NOT IN (SELECT dbo.tblSoftware.ComputerName FROM dbo.tblSoftware WHERE softwareName LIKE 'Sophos AutoUpdate') AND
computername NOT IN (SELECT dbo.tblSoftware.ComputerName FROM dbo.tblSoftware WHERE softwareName LIKE 'Sophos Remote Management System')

[Hemoco]

This thread should give you a good example : http://www.lansweeper.com/forum/yaf_postst1159_Query-for-Computers-with-No-Antivirus-Installed.aspx

should be something like this:

Select computername from tblcomputers where computername not in (SELECT ComputerName FROM dbo.tblSoftware WHERE softwareName LIKE 'Sophos Anti-Virus')

[ifm]

Thank you for helping!
IF I just get this first one I hope to learn how to make my own in the future. 🙂

I think that a check for "installed software" would be best, because the path may be different for 64 bit XP. (%ProgramFiles(x86)%)

The add/remove program "uninstall" names for Sophos are:
"Sophos Anti-Virus" + "Sophos AutoUpdate" + "Sophos Remote Management System"

For WPKG:
"WPKG"


Program path is:

"%PROGRAMFILES%\Sophos\Sophos Anti-Virus\SavMain.exe"
"%PROGRAMFILES%\Sophos\AutoUpdate\ALUpdate.exe"
"%PROGRAMFILES%\Sophos\Remote Management System\ManagementAgentNT.exe"

"%PROGRAMFILES%\wpkg\WPKGSrv.exe"