Notification

Icon
Error

Delete AntiVirusProduct WMI - Clear the anti-virus WMI class

Posted: Tuesday, November 18, 2014 4:17:10 PM(UTC)
Bert.D

Bert.D

Member Lansweeper Developer Administration Original PosterPosts: 103
4
Like
The below script will clear the anti-virus WMI class in the SecurityCenter or SecurityCenter2 namespace, depending on the Windows OS. After a reboot of the client machine, WMI will rebuild this class.

If you're running this script as a deployment package:
  • Copy the code below and save it as DelWMIAntivirus.vbs in the Program Files (x86)\Lansweeper\PackageShare\Scripts folder on your Lansweeper server.
  • Run the deployment package under your scanning credentials.

Code:
On Error Resume Next
 
Set shell = CreateObject("WScript.Shell")
Set getOSVersion = shell.exec("%comspec% /c ver")
version = getOSVersion.stdout.readall
 
Select Case True
   Case InStr(version, "n 5.") > 1 : GetOS = 0 'Windows XP
   Case InStr(version, "n 6.") > 1 : GetOS = 1 'Windows Vista, 7, 8, 8.1
   Case InStr(version, "n 10.") > 1 : GetOS = 1 'Windows 10
   Case Else : GetOS = -1
End Select
 
strComputer = "."
If GetOS = 0 Then          
    Set oWMI = GetObject( _
      "winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\SecurityCenter")
       
    Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")
     
    For Each objItem In colItems
        objItem.Delete_
    Next
End If
     
If GetOS = 1 Then  
    Set oWMI = GetObject( _
      "winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\SecurityCenter2")
       
    Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")
     
    For Each objItem In colItems
        objItem.Delete_
    Next
  
End If
Delete Antivirus WMIDownload Package
DescriptionThis package will clear the anti-virus WMI class in the SecurityCenter or SecurityCenter2 namespace, depending on the Windows OS. After a reboot of the client machine, WMI will rebuild this class.
Final ActionNothing
Max. Duration3 min(s), 0 hour(s)
RescanNo
Steps
1. Check file exists
TypeCondition
SuccessGo To Step 2
FailureStop (Failure)
Conditions
File {PackageShare}\Scripts\ DelWMIAntivirus.vbs Exists
2. Execute script
TypeScript
Return Codes 0,1641,3010
SuccessStop (Success)
FailureStop (Failure)
Command "{PackageShare}\Scripts\DelWMIAntivirus.vbs"
Options
Bert.D
#1Bert.D Member Lansweeper Developer Administration Original PosterPosts: 103  
posted: 11/20/2014 11:56:28 AM(UTC)
Additional information:

It might be that VBScript engine is unavailable after McAfee antivirus installation.
This issue may be caused either by a broken VBScript registration or by McAfee antivirus.

For McAfee:

- Open a command prompt in elevated mode (run as administrator).
- Type "regsvr32 vbscript.dll"
- Open regedit and verify that HKLM\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 is pointing to vbscript.dll
On a 64-bit machines the key is HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

There's a specific scenario when the key is overwritten by McAfee software, which change the key's value to McAfee script scanning DLL. In such a case please either uninstall McAfee then re-register vbscript.dll or contact McAfee support.

It's also possible that the same key may exist in HKCU hive.
Please delete the whole HKCU\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8} tree in such case.


Additional workaround: Please remove traces of McAfee using MCPR tool:

http://service.mcafee.co...ocument.aspx?id=TS101331
1
Neuroscience & Spine Associates
#2Neuroscience & Spine Associates Member Posts: 2  
posted: 4/6/2016 2:07:39 AM(UTC)
Also, make sure the "Security Center" and "Windows Firewall" services are enabled and running.
0

Active Discussions

Lansweeper Trying to make a custom report that sorts assets by state
by  mzipperer   Go to last post Go to first unread
Last post: Yesterday at 5:36:52 PM(UTC)
Lansweeper Report - All Assets with Specfic Default Gateway
by  RC62N   Go to last post Go to first unread
Last post: Yesterday at 4:18:08 PM(UTC)
Report Center Windows update report
by  ToeJoe   Go to last post Go to first unread
Last post: 11/24/2020 3:39:00 PM(UTC)
Lansweeper Report - assets
by  Andy.S   Go to last post Go to first unread
Last post: 11/23/2020 2:42:01 PM(UTC)
Report Center Default Browser and Version
by  hlee@fugro.com   Go to last post Go to first unread
Last post: 11/19/2020 3:50:51 PM(UTC)
Lansweeper Run Report on PCs from a list
by  RC62N   Go to last post Go to first unread
Last post: 11/16/2020 4:23:12 PM(UTC)
Lansweeper Help to Set time schedules for the last monday of the month
by  Emma Winfield   Go to last post Go to first unread
Last post: 11/16/2020 1:09:49 PM(UTC)
Lansweeper Software install, just how many computers it is installed on
by  TimHolmes1973   Go to last post Go to first unread
Last post: 11/13/2020 10:17:10 PM(UTC)