Following McAfee's use of the Mac OS X filesystem is quite a job. If you're a systems administrator, the way their VirusScan product is installed makes it complex to understand and deploy. If you're deploying with a system like Radmind, it pays to take the time to look into what gets installed and where.
Take the recently-released McAfee VirusScan 8.6 for Mac OS X — the first post-Leopard update to their anti-virus software. I must give them credit for that. They did provide support for Leopard more quickly than I can recall them doing for any other previous version of Mac OS X, going back to when the product was called Virex.
This new VirusScan still has files that are named "Virex," in the second version after the product was renamed. (Or third, if you count their questionably-named "VirusScan 8 for Mactel" product.) Look in /Library/Application Support for one example.
The /Library/Application Support/Virex/ directory includes the StuffIt and StuffItCore frameworks, presumably to scan within StuffIt archives now that the operating system itself no longer includes StuffIt. This directory also stores the VirusScan Reporter application.
VirusScan 8.6 installs a kernel extension, but it doesn't necessarily get put where you might expect. Not in /System/Library/Extensions, no — it is placed, instead, in /usr/local/vscanx/Extensions. Oh, it's named Virex.kext.
Speaking of /usr/local/vscanx, McAfee apparently decided to duplicate similar system-supplied directories there. So, you'll find "Extensions," "lib," "var," and "var/tmp" directories inside it.
There are four setuid/setgid applications in VirusScan 8.6.
The installer also modifies the local syslog.conf, adding the line:
local7.info /var/log/VirusScan.log
In VirusScan 8.5, a local user and group were created during the installation — they became UID and GID 500, as I recall. I haven't yet confirmed that with version 8.6, but it seems likely that practice has continued, so be alert because it can affect the ownership of the installed files.
Update 01/21/2008: Nathan Lewan posted helpful information about managing VirusScan 8.6 to the Radmind mailing list. (If you need to know how software gets installed, ask a Radmind admin.)