Vista *thinks* multiple antivirus programs are installed. Why?

[Guest]

Hello,

In my Windows Security Center I see the following messages:

"Multiple antivirus programs report that they are turned on and up to date"
"Windows Defender and Kaspersky Anti-Virus both report that they are turned
on"

However, I only have one installed now (AVG). I did have Kaspersky
installed, but I uninstalled it. Windows Security still thinks it is
installed. I even went through the registry and got rid of all Kaspersky
entries, and deleted all directories.

How do I "refresh" Windows Security Center to make it know only AVG is
installed?

Thanks.

 

[JerryM]

Did you reboot after you deleted Kapersky?

 

[David]

Did you reboot after you deleted Kapersky?

That's not the issue. There is a known issue with Vista's Security
Center keeping any antivirus or spyware programs hanging around long
after they are removed from the system. Cleaning out the registry with
a fine toothed comb has no effect. I hope to see this issue address
with an update to Vista in the near future.

Although I no longer have AVG or Spybot on my Vista machine, Security
Center refuses to believe they have been zapped off the system. sigh.

Dave

 

[dean-dean]

You could try this:

Right-click Command Prompt (in Start Menu\Programs\Accessories) and choose
Run as
Administrator. Type (or Copy and Paste) the following command:

winmgmt /verifyrepository

If the system returns "WMI repository is not consistent", type this command:

winmgmt /salvagerepository

The first time you run this it will fail. (It will issue stop commands to
the services causing it to fail, saying, "A stop control has been sent to a
service that other running services are dependent on"). It might take a
couple minutes for the services to shut down. Run the last command again.
You actually may have to run it 3 times before it finally runs and completes
on its own.

 

[Guest]

Thanks for the reply.

When I ran winmgmt/verifyrepository, I got

WMI repository is consistent

 

[GTS]

See
http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=1425272&SiteID=2
for several methods of repairing this problem. I prefer this one -

Open an elevated command prompt and run the following commands:

net stop winmgmt
cd /d %windir%\system32\wbem
ren repository repository.old
(or delete it using the command "rd /s repository" instead of the
ren command)
net start winmgmt

It may take a minute or so to complete while WMI rebuilds the database.

 

[dean-dean]

Well, you could try the sledgehammer approach:

Right-click Command Prompt and Run as Administrator. Type (or Copy and
Paste) the following commands, pressing Enter after each one:

net stop winmgmt
cd %windir%\system32\wbem
ren repository repository.old
net start winmgmt

This will rebuild the Repository.

Make sure the following Services are set to Automatic (the default), in
Computer Management:

Base Filtering Engine
Windows Firewall
Remote Procedure Call (RPC)
DCOM Server Process Launcher

In Windows Update, make sure KB935807 is installed.

 

[David]

Well, you could try the sledgehammer approach:

Right-click Command Prompt and Run as Administrator. Type (or Copy and
Paste) the following commands, pressing Enter after each one:

net stop winmgmt
cd %windir%\system32\wbem
ren repository repository.old
net start winmgmt

This will rebuild the Repository.

Make sure the following Services are set to Automatic (the default), in
Computer Management:

Base Filtering Engine
Windows Firewall
Remote Procedure Call (RPC)
DCOM Server Process Launcher

In Windows Update, make sure KB935807 is installed.

as far as i can see, doing that will leave the security center with the
idea that no antivirus/anti spyware software is installed. seems that's
throwing out the baby with the bathwater. I certainly wouldnt want to
spend the 45 minutes it takes to reinstall NIS2007. I've installed
NIS on 2 diff pc's with times running right around 45-50 min for the
entire process including it pulling all the updates off the 'net, using
a high speed connection. That's pain I don't want to repeat.

Dave

 

[dean-dean]

Hi David. Just to clarify, deleting the Repository folder will not affect
your installed Anti-Virus programs in any way. The Repository folder is
where Security Center finds the data it shows in its Control Panel, and it
may be finding stored data that is false or out of date. If Windows
Management sees the data as "consistent", then it will continue to show the
wrong information in Security Center. Forcing Windows to rebuild its
Repository folder may be a way to correct the information shown in Security
Center. If your Anti-Virus program has registered itself, in the registry,
that it is a program that Security Center should reckon, then hopefully the
new Repository data will reflect that, when it rescans your computer for its
(rebuilt) Repository data .

 

[David]

Hi David. Just to clarify, deleting the Repository folder will not
affect
your installed Anti-Virus programs in any way. The Repository folder is
where Security Center finds the data it shows in its Control Panel,
and it
may be finding stored data that is false or out of date. If Windows
Management sees the data as "consistent", then it will continue to
show the
wrong information in Security Center. Forcing Windows to rebuild its
Repository folder may be a way to correct the information shown in
Security
Center. If your Anti-Virus program has registered itself, in the
registry, that it is a program that Security Center should reckon,
then hopefully the new Repository data will reflect that, when it
rescans your computer for its (rebuilt) Repository data .

any idea how long that process should take? I rebooted and left vista
running for about 10 minutes or so and the security center showed
nothing installed. I ended up copying repository.old back to
repository. Now the security center is all in "the green" except for
the UAC.

Dave

 

[Guest]

That did it (after a reboot).
Thanks a lot for all the help

 

[dean-dean]

I'm glad to here things are working, and Security Center is up to date.
Thanks for reporting back.

 

[dean-dean]

Hi David. To clarify, the state of UAC is being reported incorrectly? But
the other stuff in Security Center is now correct? I imagine that putting
the Old Repository folder back, and replacing the newly created Repository,
caused an inconsistent Repository, and Windows Management somehow corrected
it. Up to a point, I guess, if your intention is to have UAC on. Do you
get the UAC prompt when running an administrative progam on your computer,
like opening Device Manager?

 

[David]

Hi David. To clarify, the state of UAC is being reported
incorrectly? But the other stuff in Security Center is now correct?
I imagine that putting the Old Repository folder back, and replacing
the newly created Repository, caused an inconsistent Repository, and
Windows Management somehow corrected it. Up to a point, I guess, if
your intention is to have UAC on. Do you get the UAC prompt when
running an administrative progam on your computer, like opening Device
Manager?

Dean, I've had UAC turned off. When i moved repository and it was
rebuilt, SC showed no spyware or antivirus or firewalls installed. I
used NIS2007 for those functions. I had followed your directions to the
letter, including rebooting, BTW. I waited a few minutes but nothing
showed up in the SC. I decided to revert back to the original
repository by running thru the process again (ie command prompt in admin
mode, stopping the service, etc). Then i opened up SC and saw the
orginal data, namely references to 2 uninstalled programs, AVG and
spybot, along with NIS2007 (which is currently in use).

Is it your contention that following your directions should have
resulted in Vista correctly reporting only the currently installed
software, namely NIS2007? IF so, how long should I need to wait for
that info to develop?

Dave

 

[blegs38552]

Thanks - had to stop and restart Security Center service, but it now
reporting correctly.

--
Neil J. Katz
708 Auth Avenue
Oakhurst, NJ 07755-2807
Tel: (732) 517-0026 (Home)
(212) 667-9189 (Bus)
E-mail - (e-mail address removed)
Fax: (646) 587-9189

 

[dean-dean]

Thank you for reporting this. I'm glad to hear things are working.

 

[Guest]

I have exactly the same problem.

Have a look at this link.

http://www.pchell.com/support/multiple_antivirus_in_security_center.shtml

I went through the process on a Win2000 Pc at work, found everything where
it was supposed to be, did what was said to do....it all seemed to work okay.
I'm going to do this to my laptop with Vista as soon as I get home tonight.