In Windows Vista, the WMI query to get anti-virus information has been changed. Pre-Vista clients used the root/SecurityCenter namespace, while Post-Vista clients use the root/SecurityCenter2 namespace. But not only the namespace has been changed, an example using the query “select * from AntiVirusProduct”:
Pre-Vista Clients (namespace root/SecurityCenter):
companyName A Company
displayName Company Product X
productUpToDate true/false
onAccessScanningEnabled true/false
versionNumber 1.2.3
Post-Vista Clients (namespace root/SecurityCenter2):
displayName Company Product X
productState 266240
The productState is not very well documented (or not at all) in the MSDN. I found some information at this msdn blog.
http://neophob.com/2010/03/wmi-query-windows-securitycenter2/