cancel
Showing results for 
Search instead for 
Did you mean: 
cccc
Level 7
Report Inappropriate Content
Message 1 of 11

Howto kill mcafee services from the command line?

Jump to solution

hi

We have VSE 8.7i SP2 installed.

One of our WIN2003 Standard SP2 server is completely hanging since 3 hours at shutdown.

It seems, cannot stop mcafee services by itself.

I've already tried to connect using mmc -> add/remove snap-in -> services, but I cannot any stop mcafee services.

I can connect to this server via remote using PsExec from Sysinternals Suite, so I have the command line.

Howto stop mcafee services from the command line?

If I try from the command line:

net stop "McAfee McShield"

System error 5 has occurred.

Access is denied.

Pls help is really urgent.

on 5/8/10 5:54:07 PM CDT
1 Solution

Accepted Solutions
HupSkiDup
Level 11
Report Inappropriate Content
Message 3 of 11

Re: Howto kill mcafee services from the command line?

Jump to solution

You could try one other thing.  connect to that machine from another box using the virusscan console , open vs console, tools, remote console (i recommend a machine on the same lan)..

when the remote console comes up.  dbl click access protection and see if you can uncheck the prevent stopping mcafee services from being stopped...

then you can try your net stop mcafeeframework and see if it that helps the deal..

10 Replies
Reliable Contributor rmetzger
Reliable Contributor
Report Inappropriate Content
Message 2 of 11

Re: Howto kill mcafee services from the command line?

Jump to solution

cccc wrote:

hi

We have VSE 8.7i SP2 installed.

One of our WIN2003 Standard SP2 server is completely hanging since 3 hours at shutdown.

It seems, cannot stop mcafee services by itself.

I've already tried to connect using mmc -> add/remove snap-in -> services, but I cannot any stop mcafee services.

I can connect to this server via remote using PsExec from Sysinternals Suite, so I have the command line.

Howto stop mcafee services from the command line?

If I try from the command line:

net stop "McAfee McShield"

System error 5 has occurred.

Access is denied.

Pls help is really urgent.

on 5/8/10 5:54:07 PM CDT

Yes, that is expected. From version 8.5i on, self-protection mechanisms exist to stop malware from terminating VSE. Thus, unless you specifically shut Off these self-protection settings, other processes and programs will not be successful at terminating VSE. This is by design. Running 'net stop mcshield' (or other McAfee services) will not work. Again, you would have to turn off the self protection measures first before these services can be stopped from the command line.

Since this is happening at shutdown, there is not much you can do, but power cycle the system and hope for the best. By now, any services that have responded to the shutdown notification, have responded and shut down.

I for one, have added UPHClean (User Profile Hive Cleanup service) to Windows 2003 and down. (This service has been included with Windows Vista and up.) This could help with the shutdown process for the future.

http://www.microsoft.com/downloads/details.aspx?FamilyID=1B286E6D-8912-4E18-B570-42470E2F3582&displa... for more information on UPHClean.

Good luck,

Ron Metzger

Thanks,
Ron Metzger

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
HupSkiDup
Level 11
Report Inappropriate Content
Message 3 of 11

Re: Howto kill mcafee services from the command line?

Jump to solution

You could try one other thing.  connect to that machine from another box using the virusscan console , open vs console, tools, remote console (i recommend a machine on the same lan)..

when the remote console comes up.  dbl click access protection and see if you can uncheck the prevent stopping mcafee services from being stopped...

then you can try your net stop mcafeeframework and see if it that helps the deal..

cccc
Level 7
Report Inappropriate Content
Message 4 of 11

Re: Howto kill mcafee services from the command line?

Jump to solution

Thx, connect to that machine from another box using the virusscan console seems to work well.

Highlighted

Re: Howto kill mcafee services from the command line?

Jump to solution

Hi,

As we are stopping the service from command line, there should be some command line solution to do "uncheck the prevent stopping mcafee services from being stopped".

I have not find any solution to do so using command line. Please let me know any possible way to do so.

 

Thanks & Regards,
Ankur

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 6 of 11

Re: Howto kill mcafee services from the command line?

Jump to solution

Hi @ankgupta4

Our products are designed to not be allowed to stop. As a security vendor we expect to see malicous processes attempt to stop us and therefore we have in-built protection to not allow this. As a result of this though there is no way you can stop our processes via command line or via the services panal. You would need to manipulate the services in safe mode to disable them.

Please feel free to submit an Idea to our forum: https://kc.mcafee.com/corporate/index?page=content&id=KB60021

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
VR
Level 7
Report Inappropriate Content
Message 7 of 11

Re: Howto kill mcafee services from the command line?

Jump to solution

Then perhaps "as a security vendor" you should also try, for a change, writing software that does not need to be restarted because of how BUGGY it is!  Your mc**bleep** sorry mcshield is eating ONE full CPU core (and 1GB RAM) despite on-access scan being "disabled" in your worthless Console!

PS: In case you'd care to know, it started eating CPU like crazy after I resized an existing NTFS partition/volume.

PPS: I'd give you the version information from your worthless Console "About" section if your worthless Console let me copy-paste it (which it doesn't).  Worthless.  EndPoint Security 10.6 is all I'm going to bother to type.

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 8 of 11

Re: Howto kill mcafee services from the command line?

Jump to solution

@VR I apologize that you are clearly having a difficult experience at this time. However, it sounds like you have a situation on your hands that our Support technicians would be able to assist you with investigating and resolving, if you would please give us a call.

There often are explanations for increased resource consumption once investigated--for example, if a process or action with high I/O is being scanned, then an unexpected amount of resources may be used as we're trying to keep up with the requests. Often times, it is found that a strategic exclusion can resolve the issue. 

If you'd like, you can also review KB89354 which provides troubleshooting starting points for identifying the cause of your issue. KB86691 provides data collection instructions if you'd like to proceed with those options prior to giving us a call.

Review of these articles is not required before giving us a call, but I wanted to provide you with options.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

VR
Level 7
Report Inappropriate Content
Message 9 of 11

Re: Howto kill mcafee services from the command line?

Jump to solution

Well, in this case McShield was supposed to be DISABLED ant not scan ANY process, whether high I/O or low I/O.  I'll look at the KBs.

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 10 of 11

Re: Howto kill mcafee services from the command line?

Jump to solution

@VR Is your system managed? If so, it's possible that if you disabled McShield on the endpoint that it is getting overwritten to be enabled based on policy enforcement intervals set to maintain ePO designated policies. Or, if you did change it in ePO, then it is possible that if you use tagging for policy assignment, that re-tagging could have caused a policy reversion.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community