Detect resident antivirus, antispyware, firewall.

[Dany3j]

Hello.

Is it possible to convert this vbs script to AutoIt?

VBS:

Const ForAppending = 2
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objLogFile = objFSO.OpenTextFile("Report.txt", ForAppending, True)
Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")
     For Each obj in oWMI.ExecQuery("Select * from AntiVirusProduct")
     If InStr(2, Hex(obj.productState), "1", 0) = 2 Then enabled = " [Enabled" Else enabled = " [Disabled"
     If InStr(4, Hex(obj.productState), "0", 0) = 4 Then updated = "|Updated] " Else updated = "|Outdated] "
     objLogFile.Write("AntiVirus: " _
         & obj.displayName _
         & Enabled _
         & Updated _
         & vbCrLf )
Next
For Each obj in oWMI.ExecQuery("Select * from AntiSpywareProduct")
     If InStr(2, Hex(obj.productState), "1", 1) = 2 Then enabled = " [Enabled" Else enabled = " [Disabled"
     If InStr(4, Hex(obj.productState), "0", 1) = 4 Then updated = "|Updated] " Else updated = "|Outdated] "
     objLogFile.Write("AntiSpyware: " _
         & obj.displayName _
         & Enabled _
         & Updated _
         & vbCrLf )
Next
For Each obj in oWMI.ExecQuery("Select * from FirewallProduct")
     If InStr(2, Hex(obj.productState), "1", 1) = 2 Then enabled = " [Enabled] " Else enabled = " [Disabled] "
     objLogFile.Write("Firewall: " _
         & obj.displayName _
         & Enabled _
         & vbCrLf )
Next

Currently use this, but only shows the Aantivirus and in case you have two AntiVirus installed shows only one in the msgbox:

_AV()
Func _AV()
Local $avname
If @OSVersion = "WIN_XP" Then
$oWMI = ObjGet("winmgmts:\\localhost\root\SecurityCenter")
Else
$oWMI = ObjGet("winmgmts:\\localhost\root\SecurityCenter2")
EndIf
$colItems = $oWMI.ExecQuery("Select * from AntiVirusProduct")
For $objAntiVirusProduct In $colItems
$avname = $objAntiVirusProduct.displayName
Next
If $avname = False Then
MsgBox(0,"AV","You must install an antivirus")
else
MsgBox(0,"AV", $avname)
EndIf
EndFunc

Thanks.

[BrewManNH]

In researching this, I have come to the conclusion that the .productstate values aren't documented, so checking for specific values in specific areas won't yield much information. There's a lot of guess work involved in every link I've read as to what each value means, but they tend to differ depending on which site you go to.

[Dany3j]

Hello.

Well, here I leave a code to detect the Antivirus, if is enabled and updated.

Thanks.

_AV()
Func _AV()
If @OSVersion = "WIN_XP" Then
$oWMI = ObjGet("winmgmts:localhostrootSecurityCenter")
Else
$oWMI = ObjGet("winmgmts:localhostrootSecurityCenter2")
EndIf

$avname=""
$colItems = $oWMI.ExecQuery("Select * from AntiVirusProduct")
For $objAntiVirusProduct in $colItems
if stringmid ($objAntiVirusProduct.productState,4,1) = 2 then
$enable =" [Enable"
else
$enable =" [Disable"
if stringmid ($objAntiVirusProduct.productState,5,1) = 4 then
$update ="|Updated]"
Else
$update ="|Outdated]"
endif
endif


$avname = $avname & $objAntiVirusProduct.displayName & $enable & $update & @CRLF
Next
If $avname = False Then
MsgBox(0,"AV","should install an antivirus")
Else
MsgBox(0,"AV", $avname)
EndIf
EndFunc

Can be improved.

Salu2.

[JohnOne]

It gets the name of my antivirus, but says it's disable and outdated, It only updated this morning and is certainly enabled.

[BrewManNH]

Same here JohnOne, says everything is disabled or outdated, because the values returned by .productstate doesn't correspond to what the script is expecting to see, even though everything is up to date.

[armoros]

Interesting

But don't work for me.

[Dany3j]

To me really works. Try the vbsscript.

[armoros]

Thank you Dany.

[Chimaera]

It shows some of the info for me the antivirus name and that it is enabled but not the update part

[BrewManNH]

As stated, no one but Microsoft knows for sure what's returned by ".productstate", so unless you know exactly what your version of software returns, it's not going to help much.

[Dany3j]

Here some references:

http://msdn.microsoft.com/en-us/library/gg537273(v=vs.85)

http://msdn.microsoft.com/en-us/library/jj155490(v=vs.85)

Do not know if something can be done directly from AutoIt.

In what may I add the code for firewall and antispyware.

Regards.

[BrewManNH]

Unfortunately neither of those links point to anything related to this script, plus those links only apply to Windows 8 and not Windows 7 or below.

[Dany3j]

I thought it had something to do.

Any other solution?

Edited July 1, 2012 by Dany3j

[d0rkye]

This is what i'm using it works with xp and 7, 8 . Hope it will help someone. Tested with MSE, Avira, Avast.

Global $state
If @OSVersion = "WIN_XP" Then
$oWMI = ObjGet("winmgmts:\\localhost\root\SecurityCenter")
$colItems = $oWMI.ExecQuery("Select * from AntiVirusProduct")
For $objAntiVirusProduct In $colItems
$state = $objAntiVirusProduct.onAccessScanningEnabled
Next
if $state = True Then
MsgBox(0,"Info","AV Enabled")
Else
MsgBox(0,"Info","AV Disabled")
EndIf
Else
$oWMI = ObjGet("winmgmts:\\localhost\root\SecurityCenter2")
$colItems = $oWMI.ExecQuery("Select * from AntiVirusProduct")
For $objAntiVirusProduct In $colItems
$state = $objAntiVirusProduct.productstate
Next
Dim $AvStatus = Hex($state)
If StringMid($AvStatus, 5, 2) = "10" Or StringMid($AvStatus, 5, 2) = "11" Then
MsgBox(0, "Info", "AV Enabled")
ElseIf StringMid($AvStatus, 5, 2) = "00" Or StringMid($AvStatus, 5, 2) = "01" Then
MsgBox(0, "Info", "AV Disabled")
EndIf
EndIf