Cannot uninstall OnAccessScanner

[powe]

Hi, I'm trying to run the following command on VSE 8.8 P13:

vse880.msi REMOVE=OnAccessScanner

but i fails every time. vse880.msi REMOVE=AccessProtection works.

Looking at the logs i can see

.msi log:

Invoking MfeVsAch: "C:\Program Files\McAfee\VirusScan Enterprise\MfeVsAcH.exe" AddAACStickyPolicy
!> Error - Could not add sticky AAC policy: -1

MfeVsAcH_<date>.log:

>> Start do_AddAACStickyPolicy
Failed to get AAC interface!. Ret: 126
>> The loaded modules in \Device\HarddiskVolume2\Program Files (x86)\McAfee\VirusScan Enterprise\MfeVsAcH.exe

>> C:\Program Files (x86)\McAfee\VirusScan Enterprise\MfeVsAcH.exe (0x00400000)
>> ....
>> <Listing a couple of dlls>
>> ....
>> AAC control is NULL!
>> The loaded modules in \Device\HarddiskVolume2\Program Files (x86)\McAfee\VirusScan Enterprise\MfeVsAcH.exe

>> C:\Program Files (x86)\McAfee\VirusScan Enterprise\MfeVsAcH.exe (0x00400000)
>> ....
>> <Listing a couple of dlls>
>> ....
>> Failed to add VSE AAC Sticky policy
<< Exit do_AddAACStickyPolicy. Return: -1

This is the closest kb to my problem that I've found

Altough it's not exactly the same, since I'm doing an uninstall and my vse8.8.0.core_uninstall_xxxxxx_xxxxxx.log is not reporting the same errors as the install log in the kb. I checked the dlls logged in MfeVsAcH_<date>.log with the vtpinfo and sigcheck commands and they all report valid. I've added the root certificates from this kb.

I've tried on both Windows 7 and Windows 10, none of them work.

Hope the log excerpts are enough, i cannot export from the system I'm working in so i have to write them by hand 😥 But I'm happy to search through them for any information needed!

[AjaySundar]

Hi @powe,

Good day to you!

Unfortunately, it is not possible to remove the OnAccessScanner.

Could you please confirm if there are any specific reasons why you are trying to remove the OnAccessScanner?

You could keep the OAS in a disabled state if you do not use it.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[powe]

Hi! In my experience, it is possible to remove OAS, since the same command runs fine on 2012 R2, but maybe this isn't officially supported? We're just disabling OAS temporarily.

Unless this is something fixable, I'll just disable the McShield service for now.

[AjaySundar · Accepted solution]

Yes, you are right, The removal of OAS is not officially documented/supported. Even if you try to ignore the inclusion of the OAS during the command-line installation of the product it will still get the OAS installed and enabled.

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?