Notification

Icon
Error

Delete Antivirus WMI - Clear the antivirus WMI class

Posted: Tuesday, November 18, 2014 4:17:10 PM(UTC)
Bert.D

Bert.D

Member Lansweeper Developer Administration Original PosterPosts: 103
2
Like
This will clear the antivirus WMI class for both SecurityCenter as SecurityCenter2.

After a reboot, WMI will rebuild this class.
Rescanning after a reboot will give the correct installed antivirus information.

Rem: Run script under scanning credentials
Rem: Copy the code below and save it as DelWMIAntivirus.vbs at the {PackageShare}\Scripts folder

Code:
On Error Resume Next

Set shell = CreateObject("WScript.Shell")
Set getOSVersion = shell.exec("%comspec% /c ver")
version = getOSVersion.stdout.readall

Select Case True
   Case InStr(version, "n 5.") > 1 : GetOS = 0 'pre vista
   Case InStr(version, "n 6.") > 1 : GetOS = 1 'vista/post vista
   Case Else : GetOS = -1
End Select

strComputer = "."
If GetOS = 0 Then    	    
	Set oWMI = GetObject( _
	  "winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\SecurityCenter")
	  
	Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")
	
	For Each objItem In colItems
		objItem.Delete_
	Next
End If
	
If GetOS = 1 Then   
	Set oWMI = GetObject( _
	  "winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\SecurityCenter2")
	  
	Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")
	
	For Each objItem In colItems
		objItem.Delete_
	Next
 
End If
Delete Antivirus WMIDownload Package
DescriptionThis will clear the antivirus WMI class for both SecurityCenter as SecurityCenter2.

After a reboot, WMI will rebuit this class.
Rescanning after a reboot will give the correct installed antivirus information.
Final ActionNothing
Max. Duration3 min(s), 0 hour(s)
RescanNo
Steps
1. Check file exists
TypeCondition
SuccessGo To Step 2
FailureStop (Failure)
Conditions
File {PackageShare}\Scripts\ DelWMIAntivirus.vbs Exists
2. Execute Script
TypeScript
Return Codes 0,1641,3010
SuccessStop (Success)
FailureStop (Failure)
Command "{PackageShare}\Scripts\DelWMIAntivirus.vbs"
Bert.D
#1Bert.D Member Lansweeper Developer Administration Original PosterPosts: 103  
posted: 11/20/2014 11:56:28 AM(UTC)
Additional information:

It might be that VBScript engine is unavailable after McAfee antivirus installation.
This issue may be caused either by a broken VBScript registration or by McAfee antivirus.

For McAfee:

- Open a command prompt in elevated mode (run as administrator).
- Type "regsvr32 vbscript.dll"
- Open regedit and verify that HKLM\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 is pointing to vbscript.dll
On a 64-bit machines the key is HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

There's a specific scenario when the key is overwritten by McAfee software, which change the key's value to McAfee script scanning DLL. In such a case please either uninstall McAfee then re-register vbscript.dll or contact McAfee support.

It's also possible that the same key may exist in HKCU hive.
Please delete the whole HKCU\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8} tree in such case.


Additional workaround: Please remove traces of McAfee using MCPR tool:

http://service.mcafee.co...ocument.aspx?id=TS101331
Neuroscience & Spine Associates
posted: 4/6/2016 2:07:39 AM(UTC)
Also, make sure the "Security Center" and "Windows Firewall" services are enabled and running.

Active Discussions

Lansweeper LSAgent has forgotten x64 Windows applications
by  thoughtmonkey   Go to last post Go to first unread
Last post: Today at 8:06:40 AM(UTC)
Lansweeper Lsremote "No supported authentication methods!"
by  Duiker  
Go to last post Go to first unread
Last post: Today at 7:52:24 AM(UTC)
Lansweeper Scan Uptime.
by  TimAlex   Go to last post Go to first unread
Last post: Today at 7:32:41 AM(UTC)
Lansweeper Force SNMP?
by  kuku1122  
Go to last post Go to first unread
Last post: Today at 6:54:09 AM(UTC)
Lansweeper Performance scanning - incorrect values
by  Richard_Lan   Go to last post Go to first unread
Last post: Yesterday at 4:26:02 PM(UTC)
Lansweeper Windows firewall rules
by  pryan67  
Go to last post Go to first unread
Last post: Yesterday at 2:56:52 PM(UTC)
Lansweeper Run outside of our domain?
by  pryan67   Go to last post Go to first unread
Last post: Yesterday at 2:53:05 PM(UTC)
Lansweeper Add logic to certain ticket submission
by  Esben.D  
Go to last post Go to first unread
Last post: Yesterday at 1:02:46 PM(UTC)