in the relevant hostchecker policy, do a new rule of type "Custome: File"
give it a name (no spaces), and in the criteria box type the path & file name.
(In the case of Sophos, I use "c:\program files\sophos\sophos anti-virus\*.ide" )
Tick "required", and in the optional settings put a "file modified less than X days ago"
save that, and back in the hostchecker policy tick "require: any of the above rules"
Alternatively, rather than doing a file check you could just do a process check for the appropriate AV process - but that doesn't check when it was last updated.
