How does the Avira antivirus check work?

Last Modified

Mon Jan 07 16:35 GMT 2019

Description

  • How does the Avira Antivirus check detect the software, and detect definition updates?

Environment

  • N-sight RMM

Solution

  • The check carries out two queries - one to detect that the software is installed on the device, and the other to detect the current definition version:
    • Detection: Query the Product_Info class (in namespace root\CIMV2\Applications\Avira_AntiVir) to obtain the Product_ID and VDF_Version fields. If we successfully obtain these two values then the product is assumed to be installed, otherwise it's not.
    • Check: Query the Product_Info class to obtain the Product_ID and VDF_Version fields. Return the raw VDF_Version value directly to the server for processing.