As I see, you made it right, although the decision to query one or the other class, should depend on the OS version (see:
http://gallery.technet.microsoft.com/scriptcenter/Get-the-status-of-4b748f25). I have no XP to test, but if the OS is reporting antivirus status correctly in the security center, you should be able to get it with WMI. If security center does not see the software properly, you can't get it with WMI this way. I suggest you try
WMI explorer[
^] to get in idea in-vivo, before coding it.