'==========================================================================
'NAME		: AntiVirus Health Check
'AUTHOR		: Marcus C. Oh
'DATE		: 9/19/2006
'COMMENT	: 
'==========================================================================
Const HKLM = &H80000002
Const EVENT_TYPE_SUCCESS = 0
Const EVENT_TYPE_ERROR   = 1
Const EVENT_TYPE_WARNING = 2
Const EVENT_TYPE_INFORMATION = 4

sComputer = "."
sMcAfeePath = "SOFTWARE\Network Associates\TVD\VirusScan Enterprise\CurrentVersion"
sAVVersion = "szProductVer"
sAVDate = "szVirDefDate"

'Parameters
sCurrentVersion = ScriptContext.Parameters.Get("Current Version")
sDaysBehind = Abs(ScriptContext.Parameters.Get("Days Behind"))
bLogSuccessEvent = CBool(ScriptContext.Parameters.Get("LogSuccessEvent"))
'==========================================================================

Set oRegistry = GetObject("winmgmts:{impersonationLevel = impersonate}!\\" &_
	sComputer & "\root\default:StdRegProv")

'Retrieve registry key values
iError = oRegistry.GetStringValue(HKLM, sMcAfeePath, sAVVersion, sAVVersion)
If iError <> 0 Then
	CreateEvent 41100,EVENT_TYPE_ERROR,"Antivirus Health Check","No antivirus detected!"
Else
	iError = oRegistry.GetStringValue(HKLM, sMcAfeePath, sAVDate, sAVDate)
	If iError <> 0 Then
		CreateEvent 41100,EVENT_TYPE_ERROR,"Antivirus Health Check","No antivirus detected!"
	Else
		If Left(sAVVersion,3) < sCurrentVersion Then
			CreateEvent 41101,EVENT_TYPE_ERROR,"Antivirus Health Check","Installed version is lower than the required version." & VbCrLf & "Version: " & sAVVersion & VbCrLf & "Dat Date: " & CDate(sAVDate)
		End If
		If DateDifference(CDate(sAVDate)) > sDaysBehind Then
			CreateEvent 41102,EVENT_TYPE_WARNING,"Antivirus Health Check","DATs are greater than " & sDaysBehind & " days behind!" & VbCrLf & "Version: " & sAVVersion & VbCrLf & "DAT Date: " & CDate(sAVDate)
		End If
	End If
End If
If bLogSuccessEvent Then
	CreateEvent 41103,EVENT_TYPE_INFORMATION,"Antivirus Health Check","Version: " & sAVVersion & VbCrLf & "DAT Date: " & CDate(sAVDate)
End If

Function DateDifference(myDate)
	DateDifference = Abs(DateDiff("d", Now, myDate))
End Function

Sub CreateEvent(iEventNumber,iEventType,sEventSource,sEventMessage)
    Set oEvent = ScriptContext.CreateEvent()
    oEvent.EventNumber = iEventNumber
    oEvent.EventType = iEventType 
    oEvent.EventSource = sEventSource
    oEvent.Message = sEventMessage
    ScriptContext.Submit oEvent
End Sub