Security Center reports multiple antivirus programs

[Bruce Wilkinson]

OS is Vista Ultimate. Previous antivirus was manually removed because
uninstall failed. Used Windows Install Clean Up to remove the program, then
deleted services from registry and restarted. After reboot, deleted folder,
then deleted remaining entries from registry and restarted again. Installed
new antivirus program.

Security Center now reports 2 a/v programs, neither on or updated. There are
no traces of the old one. The program folder is gone. It's also been removed
from the recycle bin. None of the processes or services visible in Task
Manager are from the old a/v program. There are no services for it listed in
services.msc.

The new a/v has services listed in services.msc. It also has processes and
services running in Task Manager. The agent is visible in the system tray.
It's console is startable and can run scans of the system. It's status is
listed as green.

How can I determine why Security Center thinks there are 2 a/v programs?

Bruce

 

[Malke]

OS is Vista Ultimate. Previous antivirus was manually removed because
uninstall failed. Used Windows Install Clean Up to remove the program,
then deleted services from registry and restarted. After reboot, deleted
folder, then deleted remaining entries from registry and restarted again.
Installed new antivirus program.

Security Center now reports 2 a/v programs, neither on or updated. There
are no traces of the old one. The program folder is gone. It's also been
removed from the recycle bin. None of the processes or services visible in
Task Manager are from the old a/v program. There are no services for it
listed in services.msc.

The new a/v has services listed in services.msc. It also has processes and
services running in Task Manager. The agent is visible in the system tray.
It's console is startable and can run scans of the system. It's status is
listed as green.

How can I determine why Security Center thinks there are 2 a/v programs?

I don't know how you determine why, but I know what usually fixes it:

Right-click Command Prompt and Run as Administrator. Type the following
command:

winmgmt /verifyrepository

If the system returns "WMI repository is not consistent", run this command:

winmgmt /salvagerepository

The first time you run this it will fail. It will issue stop commands to
the services causing it to fail. It might take a couple minutes for the
services to shut down. Run the command again. You actually may have to
run it 3 times before it finally runs and completes on its own. Reboot your
system.

If the above doesn't work or you get "WMI repository is consistent", do the
following from an elevated cmd prompt:

net stop winmgmt [enter]
cd /d %windir%\system32\wbem [enter]
ren repository repository.old [enter]
net start winmgmt [enter]

Malke

 

[Bob]

Was the previous antivirus Norton or McAfee?

 

[Bruce Wilkinson]

Neither, it was Panda Antivirus 2007.

Bruce

Was the previous antivirus Norton or McAfee?

 

[Bruce Wilkinson]

Malke:

That seems to have solved the problem. Now only 1 a/v program is registered.

Thanks,
Bruce

OS is Vista Ultimate. Previous antivirus was manually removed because
uninstall failed. Used Windows Install Clean Up to remove the program,
then deleted services from registry and restarted. After reboot, deleted
folder, then deleted remaining entries from registry and restarted again.
Installed new antivirus program.

Security Center now reports 2 a/v programs, neither on or updated. There
are no traces of the old one. The program folder is gone. It's also been
removed from the recycle bin. None of the processes or services visible in
Task Manager are from the old a/v program. There are no services for it
listed in services.msc.

The new a/v has services listed in services.msc. It also has processes and
services running in Task Manager. The agent is visible in the system tray.
It's console is startable and can run scans of the system. It's status is
listed as green.

How can I determine why Security Center thinks there are 2 a/v programs?

I don't know how you determine why, but I know what usually fixes it:

Right-click Command Prompt and Run as Administrator. Type the following
command:

winmgmt /verifyrepository

If the system returns "WMI repository is not consistent", run this command:

winmgmt /salvagerepository

The first time you run this it will fail. It will issue stop commands to
the services causing it to fail. It might take a couple minutes for the
services to shut down. Run the command again. You actually may have to
run it 3 times before it finally runs and completes on its own. Reboot your
system.

If the above doesn't work or you get "WMI repository is consistent", do the
following from an elevated cmd prompt:

net stop winmgmt [enter]
cd /d %windir%\system32\wbem [enter]
ren repository repository.old [enter]
net start winmgmt [enter]

Malke
--
MS-MVP
Elephant Boy Computers
www.elephantboycomputers.com
Don't Panic!

 

[Chris Game]

Right-click Command Prompt and Run as Administrator. Type the
following command:

winmgmt /verifyrepository

Where is this stuff documented?

 

[Ramesh, MS-MVP]

winmgmt (Windows):
http://msdn2.microsoft.com/en-us/library/aa394525(VS.85).aspx

And a KB released here:

Windows Vista Security Center does not detect that Windows Live OneCare is installed and active:
http://support.microsoft.com/kb/944175


The /salvagerepository verifies the WMI repository and repairs it only if it's INCONSISTENT. So you don't have to verify it by running the "Winmgmt /Verifyrepository" command.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com
Winhelponline.com blog http://www.winhelponline.com/blog

Right-click Command Prompt and Run as Administrator. Type the
following command:

winmgmt /verifyrepository

Where is this stuff documented?