Remove any trace of an Antivirus was installed (WMI)

Hi everyone

Today I will give a small tip if you get a problem re-installing an antivirus, and it complain about there is already’s one installed or if the maintenance center list one no longer there.

Sometime it can happen that a small line is still in the WMI’s database and you can confirm it by running this command;

Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct

If it list a product no longer installed, then you can run that script to remove any invalid’s entry there;

It will remove the entry that bug, antivirus WMI class in SecurityCenter/SecurityCenter2.

A powershell code;

Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object{$_.Delete()} 

A scripted version;


On Error Resume Next

Set shell = CreateObject("WScript.Shell")
Set getOSVersion = shell.exec("%comspec% /c ver")
version = getOSVersion.stdout.readall

Select Case True
   Case InStr(version, "n 5.") > 1 : GetOS = 0 'pre vista
   Case InStr(version, "n 6.") > 1 : GetOS = 1 'vista/post vista
   Case Else : GetOS = -1
End Select

strComputer = "."
If GetOS = 0 Then          
    Set oWMI = GetObject( _
      "winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\SecurityCenter")

    Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")

    For Each objItem In colItems
        objItem.Delete_
    Next
End If

If GetOS = 1 Then  
    Set oWMI = GetObject( _
      "winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\SecurityCenter2")

    Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")

    For Each objItem In colItems
        objItem.Delete_
    Next

End If

Scripted method from there

 

Thanks

 

Advertisements
This entry was posted in Uncategorized. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s