Mailing List Archive: Virus version checking

Rossow, Travis L. wrote:
> Forgive my ignorance as I am a new user to Nessus.
>
>
>
> We are using Tenable Security Center 3. I would like to scan a range of
> devices and have it report if antivirus is installed, is it running, and
> if the definitions are updated. I try to run a scan on the plugins
> 16193 and 21725, but I do not get any results. I don't see anything in
> the logs regarding failures. Any help would be appreciated.
>
>

Hi Travis,

As a customer, you can always open a support ticket with us with these
sorts of questions.

For auditing anti-virus, you should read these two blog entries which
outline what Nessus can and can't check and what we're it is looking
for:

http://blog.tenablesecurity.com/2008/07/auditing-anti-v.html
http://blog.tenablesecurity.com/2007/02/auditing_antivi.html

Check 16193 only reports if there is a problem, not if there is a good
working AV solution.

If you want to simply look for a certain AV solution such as Symantec,
you can create a .audit policy and perform a compliance scan which
will report any system not running Symantec by looking at the running
process, registry setting or anyone other parameter you want to.

Ron Gula
Tenable Network Security

_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus