During our review of antivirus products we discovered a problem that arises from removing temporarily installed antivirus products for test purposes. This problem will also show up if/when users try out a program then decide they don't like it prompting them to uninstall the disfavored antivirus program. This web page will describe the problem and the solution for said problem.
The problem we found was that the Vista Security Center was reporting virus protection programs as "On" even though this product had been removed via the "Programs and Features" module of "Control Panel". This prevents Security Center alerts as to the status of antivirus products that are installed. This includes "Out of Date" alerts as well as whether or not an AV is actually running on the machine. Although not as bad as connecting a Windows XP machine to the Internet without Service Pack 2 or a firewall installed and running, this situation could have dire consequences.
To check your machine for this problem open Control Panel and click on Security Center. Don't be fooled if everything is green in this dialog. Do click the down arrow at the far right of the "Malware Protection" section.
The "Malware protection" portion of Security Center is divided into two sections, "Virus protection" and "Spyware and other malware protection". If the "Virus protection" reports multiple antivirus programs it will also have the "Show me the antivirus programs on this computer." link.
Clicking this link opens the dialog shown here with a close up view of the contained list beneath. If your "Installed virus protection programs" dialog is showing more than one AV with the status of "On", please continue reading. It was mentioned on the AV review page that this is a problem with the programs and not with Vista. This is a safe statement to make, since only three out of the seven products reviewed showed any residual affects to the Security Center.
Out of curiosity, it was decided to check the "Spyware Protection" programs list. Unfortunately, it exhibited the same problem as the AV list dialog. Fortunately, it doesn't appear to have any listings that might affect Security Center reporting.
For the fix you need to click your "Start" button. On the resulting Start Menu, either hover on or click on "All Programs". Next click on the "Accessories" menu item. When "Accessories" has expanded, right click on "Command prompt". This opens a context menu on which you click the "Run as administrator" item. It has been recommended that the Command prompt always be opened in this manner, by the way, as this gives Administrator rights to your task.
When your command prompt opens, make sure the title bar shows "Administrator Command Prompt" as shown here. The next step is to type in "wbemtest" and hit your "Enter" key.
What you have just opened is the Windows Management Instrumentation Tester. That's a really big name for a dialog in which the only thing you are going to do is click the "Connect" button.
Upon clicking the "Connect" button, a dialog simply titled "Connect" will appear. Shorter name more to do! In the text box labeled "Namespace" change "root\cimv2" to "root\SecurityCenter". Don't use any spaces or you will get an error message when you click the "Connect" button.
The connect dialog disappears and the WMI tester dialog changes. This time the task is to click the "Enum Classes" button.
After clicking the "Enum Classes" button, the "Superclass Info" dialog opens. On this dialog click the "OK" button.
This action brings up the "Query Result" dialog. Toward the bottom of the result list you will see the entries "AntiSpywareProduct", "AntiVirusProduct" and "FirewallProduct". It will be necessary to go through these items one at a time repeating the next few steps for each item at the bottom of the list. Pick one and double click on it.
The next window that opens is the "Object Editor" for whichever product you chose to double click. All you have to do on this window is click the button labeled "Instances".
The next dialog to open will show the "Instances" of the product you double clicked. This screen shot was taken after clearing up the problem. Originally there were four instances listed. Unless you know which instance represents the product installed on your machine, click each item on the list then click the delete button. The product you have installed will recreate its instance so get 'em all to be sure. Now close windows until you get back to the "Query Result" dialog on which the products were listed and double click the next item repeating these last steps until all traces of uninstalled programs are gone.
You will know you are on the right track when you start seeing these warnings from Security Center again. To finalize the procedure it may be necessary to reboot. Everything appeared to be in working order after closing all the windows opened in this procedure, however, it never hurts to reboot. It would also be a good idea to open Security Center and make sure everything has been cleaned up.
Microsoft, Microsoft Office, Windows, Windows XP and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other names have been included in the above text that are trademarks of the respective companies.
