False virus protecton warning

[BillB65]

Shows Security Suite installed twice with one app "on" and one app"off". Can't delete the "off" one. See photos:

[IT_WinSec]

Hello @BillB65 

Thank you for posting in the HP Support Community.

This problem is likely caused by corruption to the database in the   C:\Windows\System32\Wbem\Repository   folder. This area is used by the Windows operating system to manage the Windows Management Instrumentation (WMI) service. In turn, the WMI service is used by Windows to obtain and correctly display information related to the Windows Security Center / Defender / Action Center.

To ensure that accurate information regarding your antivirus protection is displayed in the Windows Security Center or Action Center, please follow the steps below:

1. Click Start , type Run and open it.
   The Run window will be displayed. Type services.msc and click OK.
   
   

   
    

2. The Services window will appear. Scroll down the list and locate the Windows Management Instrumentation service.
    
3. Right-click the service and click Stop. Close the Services window.
   
   

   
   
   
    

4. Using Windows Explorer / File Explorer / Computer, go to  C:\Windows\System32\Wbem\Repository     directory.
    Select all and make sure you delete all files and folders (everything) inside Repository.
   Make sure you keep the folder Repository, just purge its content.
   
   
5. Restart the computer. Here is how to do it >> https://www.digitalcitizen.life/7-ways-shut-down-or-restart-windows-10-pc-or-device
   
   
6. The WMI service will launch, all files in the folder C:\Windows\System32\Wbem\Repository will be restored, and the information in the Windows Security Center will be updated. Note that the PC may be temporary slower than usual until the information is populated back into WMI repository.

Hope this helps. Let me know how it goes.

[BillB65]

system won't let me delete the files: states, "open in application inormation". 

[IT_WinSec]

@BillB65 

• Please, ensure your account is not a limited account but a standard account with admin rights
• May be the service has restarted itself. Files are protected by something. After you stop the Windows Management Instrument service, right click it -> choose Properties -> and ensure you set it from Automatic to Disabled. Apply to confirm the changes
• Refresh the services list and make sure that the WMI service is really stopped
• Try again to delete the files as per initial suggestion

Adding Service account to the administrators group is another possible resolution . This will grant permissions to the system to access WMI clauses. You can do that by

• Clicking Start and searching for the Command Prompt (CMD)
• Right click it and choose to run it as an administrator
• Enter this command and eventually press [ENTER] to confirm
• Repeat the initial steps eventually

Let me know how it goes. Please, provide details

[BillB65]

Never got this to work; kept saying file was in use.Wound up uninstalling F-Secure.

[IT_WinSec]

---

@BillB65 wrote:

Never got this to work; kept saying file was in use.Wound up uninstalling F-Secure.

---

Ok, so since F-Secure has been uninstalled, do you still see these messages from Action Center ?

Are you using the built-in Defender now ?

[BillB65]

Yes, I temporarily used the Windows Definder. I have now installed F-Secure and the warning messsage is gone. All systems showing green (ok). 

[IT_WinSec]

Thank you for the update.

So, the problem was not in Windows (corrupted WMI) but a corruption in the program which has been solved by reinstalling it. Good to know.

All the best !