Detect Antivirus

[BinaryBrother]

I couldn't find a satisfactory example on the forums, mainly because the interface that I'm using is undocumented and MS wants to keep it that way.

This is the first revision of this example. I just wanted to post it while I had time to give other users a better starting point.

Only works on Vista+, only gets first instance of AV found. If nobody cleans this up, I'll come back in a few days and post the finished product.

Windows XP has an interface [/root/SecurityCenter], but I don't need it.

This returns an $Array[4] with the below information.

Console:

Current AV: Microsoft Security Essentials
State: Enabled
pathToSignedProductExe:   C:\Program Files\Microsoft Security Client\msseces.exe
pathToSignedReportingExe: C:\Program Files\Microsoft Security Client\MsMpEng.exe

Func _GetAVInfo()
    Dim $lArray[4]
    $oWMI = ObjGet("winmgmts:\\localhost\root\SecurityCenter2")
    $colItems = $oWMI.ExecQuery("Select * from AntiVirusProduct")
    For $objAntiVirusProduct In $colItems
        $lArray[0] = $objAntiVirusProduct.displayName
        $lArray[1] = $objAntiVirusProduct.productstate
        $lArray[2] = $objAntiVirusProduct.pathToSignedProductExe
        $lArray[3] = $objAntiVirusProduct.pathToSignedReportingExe
    Next
    Dim $AvStatus = Hex($lArray[1])
    If StringMid($AvStatus, 5, 2) = "10" Or StringMid($AvStatus, 5, 2) = "11" Then
        $lArray[1] = "Enabled"
    ElseIf StringMid($AvStatus, 5, 2) = "00" Or StringMid($AvStatus, 5, 2) = "01" Then
        $lArray[1] = "Disabled"
    EndIf
    Return $lArray
EndFunc   ;==>_GetAVInfo

Resources:

http://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/bd97d9e6-75c1-4f58-9573-9009df5de19b/security-center-api
http://social.msdn.microsoft.com/Forums/en-US/6501b87e-dda4-4838-93c3-244daa355d7c/wmisecuritycenter2-productstate
http://screen317.spywareinfoforum.org/

http://neophob.com/2010/03/wmi-query-windows-securitycenter2

Another method to check for Antivirus/Firewall status
http://chentiangemalc.wordpress.com/2013/04/09/accessing-windows-security-centre-status-from-powershell/
http://msdn.microsoft.com/en-us/library/bb432509(VS.85).aspx

Edited August 8, 2013 by BinaryBrother

[mLipok]

Works with Trend Micro Client/Server Security Agent Antivirus

 

[0]|Trend Micro Client/Server Security Agent Antivirus
[1]|270336
[2]|c:Program Files (x86)Trend MicroClient Server Security AgentPccntmon.exe
[3]|C:Program Files (x86)Trend MicroClient Server Security AgentTmListen.exe
 

 

Thanks

this is very useful

[Marcel789]

Example please D:

[supersonic]

Here we go...

 

expandcollapse popup

#include <Array.au3>


Global Const $___WMI_WBEMFLAGFORWARDONLY = 0x20 ; Causes a forward-only enumerator to be returned. Forward-only enumerators are generally much faster and use less memory than conventional enumerators, but they do not allow calls to 'SWbemObject.Clone_()'.
Global Const $___WMI_WBEMFLAGRETURNIMMEDIATELY = 0x10 ; Causes the call to return immediately.


Local $aWMISecurityCenter2 = _WMI_SecurityCenter2() ; "AntiVirusProduct", local host.
If Not @error Then
    _ArrayDisplay($aWMISecurityCenter2, "_WMI_SecurityCenter2")
Else ; Error.
    MsgBox(0, "", "ERROR!")
EndIf


; [http://social.msdn.microsoft.com/Forums/en-US/6501b87e-dda4-4838-93c3-244daa355d7c/wmisecuritycenter2-productstate/],
; [http://theroadtodelphi.wordpress.com/2011/02/18/getting-the-installed-antivirus-antispyware-and-firewall-software-using-delphi-and-the-wmi/].
Func _WMI_SecurityCenter2(Const $iSelectStatement = 0, Const $sComputerName = ".")
    Local $aReturn[6] = ["", "", "", "", "", "Unknown"]
    Local $oWMIService = ObjGet("winmgmts:\\" & $sComputerName & "\root\SecurityCenter2")
    If Not @error Then
        Local $sSelectStatement = "Select * From "
        Switch Abs(Int($iSelectStatement, Default))
            Case 1
                $aReturn[0] = "AntiSpywareProduct"
            Case 2
                $aReturn[0] = "FirewallProduct"
            Case Else ; Case 0
                $aReturn[0] = "AntiVirusProduct" ; Default.
        EndSwitch
        $sSelectStatement &= $aReturn[0]
        ; --------------------------------------------------------------------------------------------------------
        Local $colItems = $oWMIService.ExecQuery($sSelectStatement, "WQL", $___WMI_WBEMFLAGFORWARDONLY + $___WMI_WBEMFLAGRETURNIMMEDIATELY)
        If IsObj($colItems) Then
            Local $iProductState = 0
            For $colItem In $colItems
                $aReturn[1] = $colItem.displayName
                $aReturn[2] = $colItem.instanceGuid
                $aReturn[3] = $colItem.pathToSignedProductExe
                $aReturn[4] = $colItem.pathToSignedReportingExe
                ; --------------------------------------------------------------------------------------------------------
                $iProductState = Hex($colItem.productState, 8)
                Switch StringMid($iProductState, 5, 2)
                    Case "00", "01"
                        $aReturn[5] = "Disabled"
                    Case "10", "11"
                        $aReturn[5] = "Enabled"
                EndSwitch
                If $aReturn[0] <> "FirewallProduct" Then
                    Switch StringMid($iProductState, 7, 2)
                        Case "00"
                            $aReturn[5] &= " (Up-To-Date)"
                        Case "10"
                            $aReturn[5] &= " (Out-Of-Date)"
                    EndSwitch
                EndIf
            Next
        Else ; Error.
            SetError(2, 0)
        EndIf
    Else ; Error.
        SetError(1, 0)
    EndIf
    Return $aReturn
EndFunc   ;==>_WMI_SecurityCenter2

Furthermore, I've added some error checking...

Edited August 9, 2013 by supersonic

[Marcel789]

Dosn't work. I have installed AVAST - Antivirus.

[BinaryBrother]

Good lookin' out, supersonic.

@mlipok, $Array[1] is erroneous in your results. It returned the "productState" code rather than "Enabled" or "Disabled". Which indicates that I'm missing something about that productState code. Which doesn't surprise me, we're not really suppose to be using it. ;P

Reading more into your output, mlipok, I've found some more information.

https://code.google.com/p/driverpacksolution/source/browse/trunk/tools/modules/diagnostics/avScanner.js?r=337

/*

http://neophob.com/2010/03/wmi-query-windows-securitycenter2/

http://msdn.microsoft.com/en-us/library/bb432509(VS.85).aspx

 

See this tweak:

http://technet.microsoft.com/en-us/magazine/hh351215.aspx

 

 

Avira - Av enabled and updated:

266240 -> 41000

 

Avira - Av disabled and updated:

270336 -> 42000

 

Avira - Av enabled and not updated:

266256 -> 41010

 

Avira - Av disabled and not updated:

270352 -> 42010

 

Microsoft Essentional - enabled and updated:

397312 -> 61000

 

Microsoft Essentional - disabled and updated:

393216 -> 60000

*/

 

function avScanner(){

        var mrtInSystem = env_windir+'System32MRT.exe';

        var mrtInDRP = softFolder+'MRT.exe';

        

        try {

                if (fso.FileExists(mrtInSystem)) {

                        var mrtInSystemDate = fso.GetFile(mrtInSystem).DateLastModified;

                        var mrtInDRPDate = fso.GetFile(mrtInDRP).DateLastModified;

                        if (mrtInSystemDate>mrtInDRPDate) {

                                //Run av-scanner from Windows

                                WshShell.Run(mrtInSystem,1,false);

                        }

                        else {

                                //Run av-scanner from DRP

                                WshShell.Run(mrtInDRP,1,false);

                        }

                }

                else if (is64) {

                        winRun(mrtInSystem,'','',true);

                }

                else {

                        //Run av-scanner from DRP

                        WshShell.Run(mrtInDRP,1,false);

                }

        }

        catch(e) { alert(avScanner_error); }

}

 

 

function avStatus(type){

        

        

        var ret=false;

        if (OSVersion >= 6) {

                var productState = parseInt(antivirus[0].productState).toString(16);

                

                if (type=='upToDate'){

                        var parseState=productState.substring(productState.length-2,productState.length);

                        var ret=(parseState!='00'?false:true);

                }

                

                if (type=='avActive'){

                        var parseState=productState.substring(productState.length-4,productState.length-2);

                        var ret=(parseState!='10'?false:true);

                }

                

                if (type=='avType'){

                        var parseState=productState.substring(productState.length-6,productState.length-4);

                        var ret=parseState;

                }

        }

        else {

                if (type=='upToDate'){

                        var parseState=antivirus[0].productUptodate;

                        var ret=(parseState!=='false'?true:false);

                }

                

                if (type=='avActive'){

                        var parseState=antivirus[0].onAccessScanningEnabled;

                        var ret=(parseState!=='false'?true:false);

                }

                

                if (type=='avType'){

                        return false;

                }

        }

        

        return ret;

}

 

function avStatus_alert(){

        if (antivirus.length==0) { return false; }

        var ant='';

        var ant_before="<div class='alert alert-block alert-diagn' id='antivirus-alert'><button type='button' class='close' data-dismiss='alert'>×</button>";

        var ant_after="</div>";

        var ant_offer_reinstall='<div id="antivirus-alert-btn"><a href="#" class="btn btn-info" onclick="antivirus_inst(); return false;" id="avScanner_installNewAv">'+avScanner_installNewAv+'</a> &nbsp;&nbsp; <a href="#" class="btn btn-warning btn-mini" onclick="return avRemove();" id="avScanner_remove">'+avScanner_remove+'</a></div>';

 

        //Debug

        //if ((avStatus('avActive'))||(avStatus('upToDate'))){

        

        if ((!avStatus('avActive'))&&(!avStatus('upToDate'))){

                ant=ant_before+avScanner_notActiveNotUpToDate+ant_offer_reinstall+ant_after;

                addDiagAlert('antivirus','Antivirus','warning');

        }

        else if (!avStatus('avActive')){

                ant=ant_before+avScanner_notActive+ant_offer_reinstall+ant_after;

                addDiagAlert('antivirus','Antivirus','warning');

        }

        else if (!avStatus('upToDate')){

                ant=ant_before+avScanner_notUpToDate+ant_offer_reinstall+ant_after;

                addDiagAlert('antivirus','Antivirus','warning');

        }

        document.getElementById('avStatus_alert').innerHTML=ant;

}

 

@Marcel789,
What OS are you running?
What is the current state of UAC?
What happens when you "Run as Administrator"?
What exactly happens when you run this?

Edited August 7, 2013 by BinaryBrother

[mLipok]

this is new computer, with Demo Antyvirus

The customer will integrate antivirus software.
Everything will be uninstalled and installed the new software.

[BinaryBrother]

@mlipok, Found it! Your AV is out of date? ^.^
 

find /i "397312" AVstate.txt>nul && set updatestatus=Antivirus up to date!
find /i "393216" AVstate.txt>nul && set scanstatus=(On Access scanning [b]disabled[/b]!)
find /i "266240" AVstate.txt>nul && set updatestatus=Antivirus up to date!
find /i "270336" AVstate.txt>nul && set updatestatus=[color=red][b]Antivirus out of date![/b][/color]
find /i "266256" AVstate.txt>nul && set updatestatus=[color=red][b]Antivirus out of date![/b][/color]
find /i "262144" AVstate.txt>nul && set updatestatus=Antivirus up to date! 
find /i "262144" AVstate.txt>nul && set scanstatus=(On Access scanning [b]disabled[/b]!)
find /i "262160" AVstate.txt>nul && set updatestatus=[color=red][b]Antivirus out of date![/b][/color]
find /i "262160" AVstate.txt>nul && set scanstatus=(On Access scanning [b]disabled[/b]!)
find /i "266240" AVstate.txt>nul && set updatestatus=Antivirus up to date! 

This came from Secret317's SecurityCheck tool.

Edited August 7, 2013 by BinaryBrother

[guinness]

It found mine. BinaryBrother, I do have a couple of points to add.

• Create a small example of usage as not everyone will understand what to do.
• Don't use Dim, use Local instead as $lArray might be defined as Global in someones script. UDFs and examples should never use Dim, well actually Dim should never be used period.

#include <Array.au3>

Example()

Func Example()
    ; Store the array returned by _GetAVInfo() in a variable
    Local $aAntiVirusInfo = _GetAVInfo()

    ; Display the 4 element array.
    _ArrayDisplay($aAntiInfo)
EndFunc   ;==>Example

[mLipok]

Funny

This is new Dell Vostro with Intel i7 buyed one week ago

[mLipok]

 

[0]|ESET Smart Security 6.0

[1]|Enabled

[2]|C:Program FilesESETESET Smart Securityecmd.exe

[3]|C:Program FilesESETESET Smart Securityx86ekrn.exe

[guinness]

Funny

This is new Dell Vostro with Intel i7 buyed one week ago

it could have been sitting in the warehouse a lot longer.

[mLipok]

it is quite likely

[mLipok]

Dosn't work. I have installed AVAST - Antivirus.

 

Maybe You have problem with WMI ?

Try This

expandcollapse popup

#include <Array.au3>


Global Const $___WMI_WBEMFLAGFORWARDONLY = 0x20 ; Causes a forward-only enumerator to be returned. Forward-only enumerators are generally much faster and use less memory than conventional enumerators, but they do not allow calls to 'SWbemObject.Clone_()'.
Global Const $___WMI_WBEMFLAGRETURNIMMEDIATELY = 0x10 ; Causes the call to return immediately.


Local $aAVInfo = _GetAVInfo() ; Local host.
$error = @error
$extended = @extended
If Not $error Then
    _ArrayDisplay($aAVInfo, "$aAVInfo")
Else ; Error.
    MsgBox(0, "ERROR!", $error & @CRLF & $extended)
EndIf


Func _GetAVInfo($sComputerName = ".")
    Local $aReturn[4]
    Local $oWMIService = ObjGet("winmgmts:\\" & $sComputerName & "\root\SecurityCenter2")
    Local $error = @error
    ConsoleWrite('IsObj() = ' & IsObj($oWMIService) & @CRLF)
    If Not $error Then
        Local $colItems = $oWMIService.ExecQuery("Select * From AntiVirusProduct", "WQL", $___WMI_WBEMFLAGFORWARDONLY + $___WMI_WBEMFLAGRETURNIMMEDIATELY)
        If IsObj($colItems) Then
            For $colItem In $colItems
                $aReturn[0] = $colItem.displayName
                $aReturn[1] = $colItem.productState
                $aReturn[2] = $colItem.pathToSignedProductExe
                $aReturn[3] = $colItem.pathToSignedReportingExe
            Next
            Switch StringMid(Hex($aReturn[1]), 5, 2)
                Case "00", "01"
                    $aReturn[1] = "Disabled"
                Case "10", "11"
                    $aReturn[1] = "Enabled"
            EndSwitch
        Else ; Error.
            Return SetError(2, $error)
        EndIf
    Else ; Error.
        Return SetError(1, $error)
    EndIf
    Return $aReturn
EndFunc   ;==>_GetAVInfo

Post Your console message ?

Do You have MsgBox Message ?

[mLipok]

I search google

and I find this

'?do=embed' frameborder='0' data-embedContent>>

[TXTechie]

Nice! It found Symantec on Win7 (64-bit):

[0]|Symantec Endpoint Protection
[1]|Enabled
[2]|C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\WSCSavNotifier.exe
[3]|C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe

[hiho]

It works for me too

[0]|Avira Desktop
[1]|Enabled
[2]|C:\Program Files\Avira\AntiVir Desktop\wsctool.exe
[3]|C:\Program Files\Avira\AntiVir Desktop\avwsc.exe

If you change "From AntiVirusProduct" to "From FirewallProduct" it will display the firewall info

[0]|COMODO Firewall
[1]|Enabled
[2]|C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
[3]|C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

 

[BinaryBrother]

I forgot to mention that the stringmid/stringlen stuff on the product state comes from these forums. I'll post the resource later today...

[BinaryBrother]

 

It found mine. BinaryBrother, I do have a couple of points to add.

• Create a small example of usage as not everyone will understand what to do.
• Don't use Dim, use Local instead as $lArray might be defined as Global in someones script. UDFs and examples should never use Dim, well actually Dim should never be used period.

 

Thanks, guinness. Honestly, I had a brain-fart and couldn't remember if Local would initialize an array, or not. I must have had a small seizure, there. 

[willichan]

Worked with 64-bit Kaspersky on a 64-bit Win7.

Interesting to find that the 64-bit Kaspersky stores the files in Program FIles (x86).

[0]|Kaspersky Endpoint Security 8 for Windows

[1]|Enabled

[2]|C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 8 for Windows\wmiav.exe

[3]|C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 8 for Windows\x64\wmi64.exe