powershell - 通过 PowerShell 列出所有反病毒软件

Question

我有一个脚本来列出并检查是否在一台工作正常的机器上安装了多个反病毒软件。有没有比长代码更简单的更好方法？

Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct >>         
C:\temp\AVInstalled.txt
$AVName1 = "Avast"
$AVName2 = "AVG"
$AVName3 = "Avira"
$AVName4 = "Bitdefender"
$AVName5 = "ZoneAlarm"
$AVName6 = "Immunet"
$AVName7 = "ClamWin"
$AVName8 = "Comodo"
$AVName9 = "Dr.Web"
$AVName10 = "ESET"
$AVName11 = "F-Secure"
$AVName12 = "F-PROT"
$AVName13 = "G DATA"
$AVName14 = "Kaspersky"
$AVName15 = "Malwarebytes"
$AVName16 = "McAfee"
$AVName17 = "Windows Defender"
$AVName18 = "NANO"
$AVName19 = "Norton"
$AVName20 = "Spyware"
$AVName21 = "Panda"
$AVName22 = "360 Total Security"
$AVName23 = "Sophos"
$AVName24 = "Titanium"
$AVName25 = "TrustPort"
$AVName26 = "Vba32"
$AVName27 = "Viper"
$AVName28 = "Sentinel"
$AVName29 = "Webroot"
$hostname = "hostname"
$Text1 = "instanceGuid*"
$Text2 = "pathToSignedProductExe*"
$Text3 = "pathToSignedReportingExe*"
$Text4 = "productState*"
$Text5 = "timestamp*"
$Text6 = "PSComputerName*"
$AV1 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName1" -SimpleMatch -Quiet
$AV2 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName2" -SimpleMatch -Quiet
$AV3 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName3" -SimpleMatch -Quiet
$AV4 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName4" -SimpleMatch -Quiet
$AV5 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName5" -SimpleMatch -Quiet
$AV6 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName6" -SimpleMatch -Quiet
$AV7 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName7" -SimpleMatch -Quiet
$AV8 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName8" -SimpleMatch -Quiet
$AV9 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName9" -SimpleMatch -Quiet
$AV10 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName10" -SimpleMatch -Quiet
$AV11 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName11" -SimpleMatch -Quiet
$AV12 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName12" -SimpleMatch -Quiet
$AV13 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName13" -SimpleMatch -Quiet
$AV14 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName14" -SimpleMatch -Quiet
$AV15 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName15" -SimpleMatch -Quiet
$AV16 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName16" -SimpleMatch -Quiet
$AV17 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName17" -SimpleMatch -Quiet
$AV18 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName18" -SimpleMatch -Quiet
$AV19 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName19" -SimpleMatch -Quiet
$AV20 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName20" -SimpleMatch -Quiet
$AV21 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName21" -SimpleMatch -Quiet
$AV22 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName22" -SimpleMatch -Quiet
$AV23 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName23" -SimpleMatch -Quiet
$AV24 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName24" -SimpleMatch -Quiet
$AV25 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName25" -SimpleMatch -Quiet
$AV26 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName26" -SimpleMatch -Quiet
$AV27 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName27" -SimpleMatch -Quiet
$AV28 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName28" -SimpleMatch -Quiet
$AV29 = Select-String -Path C:\temp\AVInstalled.txt -Pattern "$AVName29" -SimpleMatch -Quiet
$AV = Get-Content C:\temp\AVInstalled.txt | Select-String -Pattern "$Text1", "$Text2", "$Text3", "$Text4", "$Text5", "$Text6" -NotMatch
if ($AV1 -Or $AV2 -Or $AV3 -Or $AV4 -Or $AV5 -Or $AV6 -Or $AV7 -Or $AV8 -Or $AV9 -Or $AV10 -Or $AV11 -Or $AV12 -Or $AV13 -Or $AV14 -Or $AV15 -Or $AV16 -Or $AV17 -Or $AV18 -Or $AV19 -Or $AV20 -Or $AV21 -Or $AV22 -Or $AV23 -Or $AV24 -Or $AV25 -Or $AV26 -Or $AV27 -Or $AV28 -Or $AV29 -eq 'True' )
                {
                echo "[INFO] Multiple Anti-Virus are installed on this machine: ";
                echo "$(Get-Date) - [INFO] $AV."
                }
            else{ 
                echo "There's only one Antiv-Virus installed on this machine:"
                echo "$(Get-Date) - [INFO] $AV."
                }

此外，$AV 的结果显示如下:

[INFO] Multiple Anti-Virus are installed on this machine: 
12/28/2021 17:25:50 - [INFO]   displayName              : Webroot SecureAnywhere  displayName              : Bitdefender Endpoint Security Tools Antimalware  displayName              : Windows Defender  displayName              : Webroot SecureAnywhere   .

如何删除多余的空格并为每个结果添加一个新行并像这样显示？

[INFO] Multiple Anti-Virus are installed on this machine: 
12/28/2021 17:25:50 - [INFO]   displayName: Webroot SecureAnywhere  
displayName: Bitdefender Endpoint Security Tools Antimalware  
displayName: Windows Defender  
displayName: Webroot SecureAnywhere   .

谢谢，

Answer 1

这是获取和显示该信息的一种方法...

代码...

#requires -RunAsAdministrator

$AVList = @(Get-CimInstance -Namespace 'root/SecurityCenter2' -ClassName 'AntivirusProduct')

switch ($AVList.Count)
#switch (0)
#switch (3)
    {
    0 {Write-Warning 'No AV product detected.'}
    1 {
        Write-Host 'There is just one AV product installed.'
        Write-Host ('    DisplayName = {0}' -f $AVList.displayName)
        }
    default
        {
        Write-Warning ('There are {0} AV products installed on this system.' -f $AVList.Count)
        Write-Warning ('    DisplayNames = {0}' -f ($AVList.displayName -join ', '))
        }
    }

在我的系统上有一个 AV 产品......

There is just one AV product installed.
    DisplayName = Windows Defender

如果我注释掉第一个 switch 测试并使用 3 值，我会得到这个 ...

WARNING: There are 1 AV products installed on this system.
WARNING:     DisplayNames = Windows Defender

显然，计数显示的是真实的，但您可以看到结果是 AV 项目的数量和以逗号分隔的显示名称列表。

代码的作用...

• 告诉 PoSh 脚本需要以管理员身份运行
  如果不是这种情况，PoSh 将拒绝运行此代码。
• 通过 CIM 调用获取 AV 项目列表并将列表存储在 $Var 中
• 包裹在上面一行的 @() 强制结果是一个数组
  有时它有助于强制这样......在这种情况下，它确保 .Count 属性将在那里并且是准确的。
• 使用 switch 语句根据 $AVList var 中的 AV 项目数选择要执行的操作
• 如果0，就这样说
  希望这不会出现在您的任何系统中。 [咧嘴一笑]
• 如果 1，说出来并列出 AV 显示名称
• 如果有任何其他 [默认 值]，则显示计数和显示名称列表