Notification

Icon
Error

Delete AntiVirusProduct WMI - Clear the anti-virus WMI class

Posted: Tuesday, November 18, 2014 4:17:10 PM(UTC)
Bert.D

Bert.D

Member Lansweeper Developer Administration Original PosterPosts: 103
2
Like
The below script will clear the anti-virus WMI class in the SecurityCenter or SecurityCenter2 namespace, depending on the Windows OS. After a reboot of the client machine, WMI will rebuild this class.

If you're running this script as a deployment package:
  • Copy the code below and save it as DelWMIAntivirus.vbs in the Program Files (x86)\Lansweeper\PackageShare\Scripts folder on your Lansweeper server.
  • Run the deployment package under your scanning credentials.

Code:
On Error Resume Next
 
Set shell = CreateObject("WScript.Shell")
Set getOSVersion = shell.exec("%comspec% /c ver")
version = getOSVersion.stdout.readall
 
Select Case True
   Case InStr(version, "n 5.") > 1 : GetOS = 0 'Windows XP
   Case InStr(version, "n 6.") > 1 : GetOS = 1 'Windows Vista, 7, 8, 8.1
   Case InStr(version, "n 10.") > 1 : GetOS = 1 'Windows 10
   Case Else : GetOS = -1
End Select
 
strComputer = "."
If GetOS = 0 Then          
    Set oWMI = GetObject( _
      "winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\SecurityCenter")
       
    Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")
     
    For Each objItem In colItems
        objItem.Delete_
    Next
End If
     
If GetOS = 1 Then  
    Set oWMI = GetObject( _
      "winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\SecurityCenter2")
       
    Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")
     
    For Each objItem In colItems
        objItem.Delete_
    Next
  
End If
Delete Antivirus WMIDownload Package
DescriptionThis package will clear the anti-virus WMI class in the SecurityCenter or SecurityCenter2 namespace, depending on the Windows OS. After a reboot of the client machine, WMI will rebuild this class.
Final ActionNothing
Max. Duration3 min(s), 0 hour(s)
RescanNo
Steps
1. Check file exists
TypeCondition
SuccessGo To Step 2
FailureStop (Failure)
Conditions
File {PackageShare}\Scripts\ DelWMIAntivirus.vbs Exists
2. Execute script
TypeScript
Return Codes 0,1641,3010
SuccessStop (Success)
FailureStop (Failure)
Command "{PackageShare}\Scripts\DelWMIAntivirus.vbs"
Bert.D
#1Bert.D Member Lansweeper Developer Administration Original PosterPosts: 103  
posted: 11/20/2014 11:56:28 AM(UTC)
Additional information:

It might be that VBScript engine is unavailable after McAfee antivirus installation.
This issue may be caused either by a broken VBScript registration or by McAfee antivirus.

For McAfee:

- Open a command prompt in elevated mode (run as administrator).
- Type "regsvr32 vbscript.dll"
- Open regedit and verify that HKLM\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 is pointing to vbscript.dll
On a 64-bit machines the key is HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

There's a specific scenario when the key is overwritten by McAfee software, which change the key's value to McAfee script scanning DLL. In such a case please either uninstall McAfee then re-register vbscript.dll or contact McAfee support.

It's also possible that the same key may exist in HKCU hive.
Please delete the whole HKCU\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8} tree in such case.


Additional workaround: Please remove traces of McAfee using MCPR tool:

http://service.mcafee.co...ocument.aspx?id=TS101331
Neuroscience & Spine Associates
posted: 4/6/2016 2:07:39 AM(UTC)
Also, make sure the "Security Center" and "Windows Firewall" services are enabled and running.

Active Discussions

Lansweeper Report Needed of just DEFAULT GROUP assets
by  SHib11   Go to last post Go to first unread
Last post: Today at 2:57:23 PM(UTC)
Lansweeper No longer shows up-to-date with new OS version
by  ICT Support   Go to last post Go to first unread
Last post: Today at 11:29:10 AM(UTC)
Lansweeper Do not show the computers that have a specific user
by  akuc  
Go to last post Go to first unread
Last post: Today at 10:21:45 AM(UTC)
Lansweeper adding KB numbers
by  Esben.D   Go to last post Go to first unread
Last post: Today at 8:51:54 AM(UTC)
Lansweeper Default 'warranty' Report Adjustments or Clones
by  Cripple.Zero  
Go to last post Go to first unread
Last post: Yesterday at 7:22:07 PM(UTC)
Lansweeper Password Never Expires
by  CoolDood   Go to last post Go to first unread
Last post: 10/11/2019 12:34:14 PM(UTC)
Lansweeper Average ticket time until closed 7 days, 30 days
by  JasonDawson  
Go to last post Go to first unread
Last post: 10/10/2019 4:20:03 PM(UTC)