Windows: Cleaning Orphaned Antivirus Product Entries

This article is intended for a technical audience. Making mistakes in the Windows Management Instrumentation Tester may result in errors that can only be resolved by reinstalling the operating system.

Antivirus software registers itself with Windows so it can provide status reporting and other integrations. However, when uninstalling, sometimes an antivirus product does not remove this registration properly and Windows may continue to report on the status of an antivirus product which no longer exists. In this situation the entries need to be removed manually.

1. Open an elevated command prompt.

2. Enter wbemtest.exe.

   The Windows Management Instrumentation Tester will open.

3. Click Connect.

4. Enter root\SecurityCenter2 in the Namespace field and click Connect.^†

5. Click Enum Instances.

6. Enter AntivirusProduct in the Superclass field and click OK.

   This will show the registered instances. Generally there should be only one entry:

   

7. Double-click each entry to see the full details of the item. Scroll down the list until you see the product name listed next to displayName:
   

   Click Close to close the dialog.

8. Once you have identified the errant entry, click Delete from the Query Result dialog (per step 6 above).

9. Click Close.

^† For Windows XP/Vista, enter root\SecurityCenter.