From c2bbf4a0a7971e9846515f7c52b439e81e6a6e35 Mon Sep 17 00:00:00 2001
From: mboelen <michael@cisofy.com>
Date: Wed, 1 Apr 2015 14:22:53 +0200
Subject: [PATCH] Improved detection for McAfee anti-virus (cma)

---
 include/tests_malware | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/include/tests_malware b/include/tests_malware
index 340133a6..c7744dda 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -66,9 +66,17 @@
     Register --test-no MALW-3280 --weight L --network NO --description "Check for clamscan"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
-        logtext "Test: checking process cmdagent (McAfee)"
-        IsRunning cmdagent
-        if [ ${RUNNING} -eq 1 ]; then
+        MCAFEE_RUNNING=0
+        logtext "Test: checking process cma or cmdagent (McAfee)"
+        # cma is too generic to match on, so we want to ensure that it is related to McAfee first
+        if [ -x /opt/McAfee/cma/bin/cma ]; then
+             IsRunning cma
+             if [ ${RUNNING} -eq 1 ]; then MCAFEE_RUNNING=1; fi
+           else
+             IsRunning cmdagent
+             if [ ${RUNNING} -eq 1 ]; then MCAFEE_RUNNING=1; fi
+        fi
+        if [ ${MCAFEE_RUNNING} -eq 1 ]; then
             FOUND=1
             Display --indent 2 --text "- Checking McAfee" --result "FOUND" --color GREEN
             logtext "Result: Found McAfee"