AV realtime protection enabled

[Mutlu]

Hello,

Maybe somebody have did this already, questions is, how can I see info about enabled or disabled anti-virus realtime protection on machine?
Thank you for answers.

[jonconley]

Run your antivirus solution.
Toggle the enable or disable while running regmon.
It may or not be tied to a specific process or service but chances are that enabling/disabling the real-time protection changes a value in the registry.

I would add a check on the registry for the value to equal enabled and also verify that the related process/service is running.