Technical Note: Installed macOS antivirus program not detected

[cmaheu]

Description

Scan fails to detect an Anti-Virus program that has been installed on macOS.  

Solution

The Agent scans for an AntiVirus program in the following order:
1. Install package 
2. Version

3. Definitions

Determine the install package that is being searched for by the Agent.

1.  In the Application Server CLI, navigate to the following directory:
cd /bsc/campusMgr/agent/templates/Mac-OS-X/Anti-Virus/

2.  cd to directory of specific vendor AV
3.  Review .xml file to determine the package being scanned for

Example:

cat /bsc/campusMgr/agent/templates/Mac-OS-X/Anti-Virus/Avast/avast.xml

<VersionFromScript delim="." operation="gte" required="2.0" script="/usr/sbin/pkgutil --pkg-info com.avast.AAFM | /usr/bin/grep version: | /usr/bin/sed s/[^0-9.]//g"/>
            <VersionFromScript delim="." operation="gte" required="2.0" script="/usr/sbin/pkgutil --pkg-info com.avast.avast | /usr/bin/grep version: | /usr/bin/sed s/[^0-9.]//g"/>
            <VersionFromScript delim="." operation="gte" required="2.0" script="/usr/sbin/pkgutil --pkg-info com.avast.MacAvastInstaller | /usr/bin/grep version: | /usr/bin/sed s/[^0-9.]//g"/>

Verify Install Package on the Affected Endstation

Search for specific packages on the endstation and compare to the entries in the .xml file.  Run the following command via the endstation's terminal:

pkgutil --pkgs | grep -i <keyword>

Examples:

To Check for Avast : pkgutil --pkgs | grep -i avast

To Check for ClamXAV : pkgutil --pkgs | grep -i clam
To Check for AVG : pkgutil --pkgs | grep -i avg

Solutions:

• If the package is not installed on the end station: reinstall the program.
• If the package exists on the end station, it may not be a clean install:  reinstall the program.
• If the package name differs from what is listed: collect the program information and provide to Support.  See related KB article below for details.

Related Articles

Technical Note: AntiVirus (AV) information to provide Support