Detecting Antivirus State

Question

According to http://support.microsoft.com/kb/883792 , MS can detect installed AV using either WMI or a manual method involving registry keys that MS knows about. Is there an API to access this functionality?

Answer 1

You can use the Win32 Registry access APIs if you knew the keys.

Answer 2

If you can't find documentation for it and you want to do some manual digging, you can try executing Process Monitor from SysInternals and then launch the Security Center. It'll show you what keys are read, and what files are accessed.

Answer 3

This Google search yields this MSDN documentation which appears to be what you're looking for, the Windows Security Center API. The documentation says Vista only, but I believe this API is also available through the Windows XP SP2 SDK.