Detect Antivirus on Windows using C#

Question

Is there a way to detect whether there is an antivirus software installed in a machine using C#? I know the Security Center detects antivirus software but how can you detect that in C#?

A link would be sufficient. :D

Thanks

Answer 1

You can use WMI; see here.

Answer 2

Hi,

Windows security center recognizes various antivirus softwares installed on your PC, see the following explanations:

Windows Security Center uses a two-tiered approach for detection status. One tier is manual, and the other tier is automatic through Windows Management Instrumentation (WMI). In manual detection mode, Windows Security Center searches for registry keys and files that are provided to Microsoft by independent software manufacturers. These registry keys and files let Windows Security Center detect the status of independent software. In WMI mode, software manufacturers determine their own product status and report that status back to Windows Security Center through a WMI provider. In both modes, Windows Security Center tries to determine whether the following is true:

An antivirus program is present.

The antivirus signatures are up-to-date.

Real-time scanning or on-access scanning is turned on for antivirus programs.

For firewalls, Windows Security Center detects whether a third-party firewall is installed and whether the firewall is turned on or not.

You should be able to query for the WMI provider. You need connect to the "root\SecurityCenter" root in WMI, and then query for the AntiVirusProduct class.

look at this code I wrote

using System;
using System.Text;
using System.Management;

namespace ConsoleApplication1
{
  class Program
  {
    public static bool AntivirusInstalled()
    {

      string wmipathstr = @"\\" + Environment.MachineName + @"\root\SecurityCenter";
      try
      {
        ManagementObjectSearcher searcher = new ManagementObjectSearcher(wmipathstr, "SELECT * FROM AntivirusProduct");
        ManagementObjectCollection instances = searcher.Get();
        return instances.Count > 0;
      }

      catch (Exception e)
      {
        Console.WriteLine(e.Message);
      }

      return false;
    } 

    public static void Main(string[] args)
    {
      bool returnCode = AntivirusInstalled();
      Console.WriteLine("Antivirus Installed " + returnCode.ToString());
      Console.WriteLine();
      Console.Read();
    }


  }
}

Bye.

Answer 3

This does not appear to work on vista - they no longer support writing directly to the root\securitycenter WMI namespace.

Any solution that works on XP and Vista?

Answer 4

Hi, WMI provider doesn't work for Windows Vista or Windows 7. Any other idea?

Answer 5

OESIS Framework is a uniform interface in C++ with COM/Java wrappers (C# sample available) to detect AV and other security apps (firewalls, anti-phishing, hard disk encryption, back-up, hypervisors etc. running on Windows (9x through Windows 7), Macintosh, Linux and Mobile operating systems. It is described at http://www.opswat.com/products/oesis-frameworkae

Answer 6

The WMI query changes slightly in Vista SP2 and beyond.

Try this part \root\SecurityCenter2 instead of \root\SecurityCenter

The results are slightly different as well. You can still get the display name, but you'll need to do a bit of bit masking for the ProductState field to determine if the onAccessScanner is enabled / disabled and the upToDate kind of information.