antivirusDetection.vbs

   1 On Error Resume Next
   2 Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")
   3 If objWMIService is Nothing Then
   4     Wscript.StdOut.Write "NULL"
   5 Else
   6     Set installedAntiviruses = objWMIService.ExecQuery("Select * from AntivirusProduct")
   7 'Iterates through all the antivirus software,retrieved by the WMI query,present on the system and prints only the ones that are active
   8 'this is done by checking the 12th bit of the productState property of the antivirus
   9 'if 12th bit is on then it means that the antivirus is in active state
  10 'if 12th bit is off then it is inactive.
  11 'see http://neophob.com/2010/03/wmi-query-windows-securitycenter2/
  12     count=0
  13     list=""
  14     For Each antivirus in installedAntiviruses
  15         If  antivirus.productState And &h01000 Then 'checking the state of the 12th bit of productState property of the antivirus
  16             count=count+1
  17             list=list & VBNewLine & VBtab & "*" & antivirus.displayName
  18         End if
  19     Next
  20     If count = 0 Then
  21         Wscript.StdOut.Write "NOT_FOUND"
  22     Else
  23         Wscript.Echo list
  24     End if
  25 End if