2

Does anyone know if Action/Security Center uses a registry key (or file) to determine whether or not to notify the user that no virus protection is installed? I'm not trying to turn off notifications, I'm simply trying to figure out an easy and accurate way to determine if any anti-virus is installed and hopefully the name of the AV as well.

This can't be something accessed through WMI or similar services as I only have access to the registry and files (using samba).

Improve this question
3
  • 3
    There are different mechanisms how to interface to the WSC, depending on the OS version, and all are under NDA. Not even sure I'm allowed to say that in particular, but ooops now I did :) ... none is via the registry.
    – 0xC0000022L
    Commented Mar 6, 2013 at 1:35
  • 1
    "This can't be something accessed through WMI or similar services" - Too bad, else something like WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List would have done the trick.
    – Karan
    Commented Mar 6, 2013 at 23:05
  • @Karan well that may end up helping thanks. After I accepted the fact that I wouldn't be able to find it in the registry or a file I did a little research and found that samba has some WMI support (or maybe it's a fork of samba). So if I ever get time I'll have to build this support into my product.
    – Eric
    Commented Mar 6, 2013 at 23:10

1 Answer 1

Reset to default
1

It appears that meanwhile Microsoft has opened up parts of it. It's not via the registry, but it's a crude way of getting the state of the AV, provided it interfaces with the WSC. This means it requires some programming (which is sort of out-of-scope for SuperUser but rather for StackOverflow), though.

WscRegisterForChanges allows to register a routine that will get called when the WSC state changes. But the state information is rather crude:

  • WSC_SECURITY_PROVIDER_HEALTH_GOOD
  • WSC_SECURITY_PROVIDER_HEALTH_NOTMONITORED
  • WSC_SECURITY_PROVIDER_HEALTH_POOR
  • WSC_SECURITY_PROVIDER_HEALTH_SNOOZE

As you can see there is no way to get the name of the AV, for example. Not even how current the AV signatures are is a metric available this way.

It may be possible to use WMI to query some of that information (see the previously linked StackOverflow Q&A), but at least the API for AV vendors has switched away from WMI (Vista) to COM (7 SP1?). Doesn't mean that the respective information isn't available via WMI, however.

PS: this information isn't exactly what was asked (not via registry), but it's the closest one can get these days, so I am posting it as Community Wiki.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .