NBT Support has come up with a workaround using a VB script. The process is to create and run a VB script that captures the timestamp of the file and writes that information to an INI file. You can then use the INI file in your ruleset to see modified date is what you expect. In our example below, weÂ’re checking to see if the Symantec file called savrt.dat is up to date.
First, use notepad to create a .vbs script with the lines shown below. On line 1, specify the path to the file you're interested in. On line 4, specify the path and file name for the INI file that will be created.
Const filename = "C:\Program Files\Symantec AntiVirus\savrt.dat"
Dim objFSO, objFile, objINIFile
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.GetFile(filename)
Set objINIFile = objFSO.CreateTextFile("C:\LastModified.ini", 2)
objINIFile.WriteLine "[Date Modified]"
objINIFile.WriteLine "Date Modified=" & objFile.DateLastModified
objINIFile.Close
Run the vbs script as a Command Task in your Channel, then create a config group based on the entry in the INI file created by the script. Here's our example:
EXISTS <File> "C:\Program Files\Symantec AntiVirus\savrt.dat" AND <INI Value> "C:\LastModified.ini\\Date Modified\\Date Modified" MATCHES "1/6/2006*"
pretty neat...
anyways, this is the update file but im not sure if its just this one or if it uses any of the other files...