QUOTE(Tybilly @ 25.09.2009 12:01)

Hello,
You can watch for the "Audit" menu which is under the "events" in node in Administration Kit if I remember, there may be some events related to changes made by users on settings of KAV.
I see something in there called Enabling/disabling protection components. I'm not sure if this is what I need though.