why the McAfee Validation Trust Protection Service is not stopable ?

[finkemch]

we tried to stop the "McAfee Validation Trust Protection Service" - but it is not possible - does anyone know how and why ?

- we stopped all mcafee services except the "McAfee Validation Trust Protection Service" - we get error 5 - access denied

- we disabled the access protection and disabled all rules which protect the stopping of mcafee processes

why we cant stop the "McAfee Validation Trust Protection Service" ?

Thank you for your help.

Michael

[wwarren]

This service is protected due to its integral necessity for McAfee services to function, and to hinder attempts to bypass our protection mechanisms and other root-kit behaviors.

It is not meant to ever be stopped.

[finkemch]

Hello William,

Thank you for the answer.

Good to know. Now Rootkits and Viruses have no chance to modify or disable the virusscan ?

regards

             Michael

[tonyb99]

Can you advise what this service is actually doing then? ( KB is down otherwise I would have searched assuming there is a kb on this)

[wwarren]

The MFEVTP service uses Microsoft cryptographic APIs to validate McAfee processes are loading McAfee files, and to ensure nobody else is using them.

This is a new service, and as such continues to undergo tweaks as needed and warranted from customer-reported issues.

The Windows kernel allows for kernel-level drivers to do _anything_. If that driver is a root kit you are compromised, entirely. Whatever that root-kit is designed to do, it can do it.

We've taken measures to make it more difficult for a root-kit to accomplish certain tasks with our software installed.

[Former Member]

If you are looking to completely disable all McAfee services (as I've had to do in the past to prove to software vendors that a problem is or is not related to VirusScan), in my experience, the "McAfee Validation Trust Protection Service" can be stopped if the service stop is initiated as the local SYSTEM account.

[Former Member]

I don't even know why I have this service. I don't have McAfee on my machine. I tried once to install a trial version of it, but didn't go through with it since it clashed with Norton, which I do use. So, how can I get rid of this service altogether? Notice that there is nothing to uninstall in my list of programs.

Thanks for your help

[wwarren]

I don't even know why I have this service. I don't have McAfee on my machine. I tried once to install a trial version of it, but didn't go through with it since it clashed with Norton, which I do use. So, how can I get rid of this service altogether? Notice that there is nothing to uninstall in my list of programs.

I would suggest contacting McAfee Support to fully understand just what is installed, and we can help you clean up those remnants.

There is a manual removal KB article too though if you want to take a stab at it yourself.

[Former Member]

wwarren wrote:
There is a manual removal KB article too though if you want to take a stab at it yourself.

Can you provide a link to the manual remove knowledgebase artice? I can't find it and mcafee search doesn't appear to easily return it.

I've already uninstalled McAfee, but the "McAfee Validation Trust Protection Service" is still there and won't allow me to disable it.

I'm also trying to rid myself of this registry entry, that also won't allow me to change it:

[HKEY_CLASSES_ROOT\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32]

@="C:\\Program Files\\Common Files\\McAfee\\SystemCore\\ScriptSn.20110117095641.dll"

Because my .vbs files return: Can't find script engine "VBScript" for script

Thanks

[Former Member]

Yea, please provide the exact link to the Knowledge Base, can't find it either.

Unbelievable what time you have to invest to get rid of McAfee products  :shoothead:

Nachricht geändert durch pietrokulla on 25.02.13 05:50:39 CST