The Brotherhood Detecting Enabled Anti-Virus | Windows COM | WMI Query

Code

Antivirus Name: Windows Defender

State (Hex): 060100

Enabled Status: Disabled

Update Status: Up to Date



Antivirus Name: AVG Antivirus

State (Hex): 041000

Enabled Status: Enabled

Update Status: Up to Date

Code

import win32com.client



def check_antivirus_status():

    # Connect to the WMI service

    objWMIService = win32com.client.Dispatch("WbemScripting.SWbemLocator")

    swbemServices = objWMIService.ConnectServer(".", "ROOT\\SecurityCenter2")



    # Execute the WMI query to get antivirus product information

    colItems = swbemServices.ExecQuery("SELECT * FROM AntivirusProduct")



    # Check the status of each antivirus product

    for objItem in colItems:

        name = objItem.displayName

        state = objItem.productState

        state_hex = f'{state:06x}'  # Format as hex with leading zeros



        # Extract the middle two hex digits and check if enabled

        enabled_hex = state_hex[2:4]

        enabled_status = 'Enabled' if enabled_hex == '10' else 'Disabled'



        # Extract the last two hex digits for update status

        update_hex = state_hex[4:6]

        update_status = 'Up to Date' if update_hex == '00' else 'Not Up to Date'



        print(f'Antivirus Name: {name}')

        print(f'State (Hex): {state_hex.upper()}')

        print(f'Enabled Status: {enabled_status}')

        print(f'Update Status: {update_status}\n')



if __name__ == "__main__":

    check_antivirus_status()

PHP Code



<?php 
import win32com.client

def get_wmi_service(namespace):
    """Connect to the WMI service."""
    locator = win32com.client.Dispatch("WbemScripting.SWbemLocator")
    return locator.ConnectServer(".", namespace)

def fetch_antivirus_info(wmi_service):
    """Fetch antivirus product information using WMI."""
    return wmi_service.ExecQuery("SELECT * FROM AntivirusProduct")

def parse_product_state(state):
    """Parse the product state to determine enabled and update status."""
    state_hex = f'{state:06x}'
    enabled_status = 'Enabled' if state_hex[2:4] == '10' else 'Disabled'
    update_status = 'Up to Date' if state_hex[4:6] == '00' else 'Not Up to Date'
    return state_hex.upper(), enabled_status, update_status

def display_antivirus_info(products):
    """Display the antivirus product information."""
    for product in products:
        name = product.displayName
        state_hex, enabled_status, update_status = parse_product_state(product.productState)
        print(f'Antivirus Name: {name}')
        print(f'State (Hex): {state_hex}')
        print(f'Enabled Status: {enabled_status}')
        print(f'Update Status: {update_status}\n')

def check_antivirus_status():
    """Main function to check the status of antivirus products."""
    wmi_service = get_wmi_service("ROOT\\SecurityCenter2")
    products = fetch_antivirus_info(wmi_service)
    display_antivirus_info(products)

if __name__ == "__main__":
    check_antivirus_status()