Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
32357 Views 9 Replies Latest reply: Feb 25, 2013 5:49 AM by pietrokulla RSS
finkemch The Place at McAfee Member 35 posts since
Jan 19, 2004
Currently Being Moderated

Jan 15, 2010 4:40 AM

why the McAfee Validation Trust Protection Service is not stopable ?

we tried to stop the "McAfee Validation Trust Protection Service" - but it is not possible - does anyone know how and why ?

- we stopped all mcafee services except the "McAfee Validation Trust Protection Service" - we get error 5 - access denied

- we disabled the access protection and disabled all rules which protect the stopping of mcafee processes

 

why we cant stop the "McAfee Validation Trust Protection Service" ?

 

Thank you for your help.

 

Michael

  • wwarren McAfee SME 777 posts since
    Nov 3, 2009

    This service is protected due to its integral necessity for McAfee services to function, and to hinder attempts to bypass our protection mechanisms and other root-kit behaviors.

    It is not meant to ever be stopped.

  • tonyb99 Champion 3,844 posts since
    Apr 10, 2006

    Can you advise what this service is actually doing then? ( KB is down otherwise I would have searched assuming there is a kb on this)



    McAfee Maniac (Volunteer Moderator)
    x1 4.5.4 ePolicy Orchestrator Server (Build 1082)
    x1 5.0.1 ePolicy Orchestrator Server (Build 228)
    x1 4.6.3 ePolicy Orchestrator Server (Build 197)
    x1 4.6.6 ePolicy Orchestrator Server (Build 176)
    Mcafee Agent 4.6.0.2292/4.6.0.2935/4.8.0.887
    Groupshield 7.0
    VSE 8.8.0.975 & 8.7.0.570 x 20000
    DLP Endpoint 9.2.1
    EEPC 6.2.1.315/7.0.1.354
    HIPS 8
    EMM 10.2
    x70 Sophos 10.2 Endpoint Security & Control





  • wwarren McAfee SME 777 posts since
    Nov 3, 2009

    The MFEVTP service uses Microsoft cryptographic APIs to validate McAfee processes are loading McAfee files, and to ensure nobody else is using them.

    This is a new service, and as such continues to undergo tweaks as needed and warranted from customer-reported issues.

     

    The Windows kernel allows for kernel-level drivers to do _anything_. If that driver is a root kit you are compromised, entirely. Whatever that root-kit is designed to do, it can do it.

    We've taken measures to make it more difficult for a root-kit to accomplish certain tasks with our software installed.

  • runcmd Apprentice 221 posts since
    Feb 22, 2006

    If you are looking to completely disable all McAfee services (as I've had to do in the past to prove to software vendors that a problem is or is not related to VirusScan), in my experience, the "McAfee Validation Trust Protection Service" can be stopped if the service stop is initiated as the local SYSTEM account.


    ---
    Start/RunCMD...
    C:\>
    ePO v4.5 / MA v4.6.0 / VSE v8.8, P1 / Engine v5400
    MEG (IronMail) v7.6-2810
  • fmzk Newcomer 1 posts since
    Jan 18, 2011

    I don't even know why I have this service. I don't have McAfee on my machine. I tried once to install a trial version of it, but didn't go through with it since it clashed with Norton, which I do use. So, how can I get rid of this service altogether? Notice that there is nothing to uninstall in my list of programs.

     

    Thanks for your help

  • wwarren McAfee SME 777 posts since
    Nov 3, 2009
    I don't even know why I have this service. I don't have McAfee on my machine. I tried once to install a trial version of it, but didn't go through with it since it clashed with Norton, which I do use. So, how can I get rid of this service altogether? Notice that there is nothing to uninstall in my list of programs.


    I would suggest contacting McAfee Support to fully understand just what is installed, and we can help you clean up those remnants.

    There is a manual removal KB article too though if you want to take a stab at it yourself.

  • mirx Newcomer 1 posts since
    Jan 2, 2012

    wwarren wrote:

    There is a manual removal KB article too though if you want to take a stab at it yourself.

     

    Can you provide a link to the manual remove knowledgebase artice? I can't find it and mcafee search doesn't appear to easily return it.

    I've already uninstalled McAfee, but the "McAfee Validation Trust Protection Service" is still there and won't allow me to disable it.

     

    I'm also trying to rid myself of this registry entry, that also won't allow me to change it:

    [HKEY_CLASSES_ROOT\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32]

    @="C:\\Program Files\\Common Files\\McAfee\\SystemCore\\ScriptSn.20110117095641.dll"

     

    Because my .vbs files return: Can't find script engine "VBScript" for script

     

    Thanks

  • pietrokulla Newcomer 4 posts since
    Feb 23, 2013

    Yea, please provide the exact link to the Knowledge Base, can't find it either.

    Unbelievable what time you have to invest to get rid of McAfee products  :shoothead:

     

    Nachricht geändert durch pietrokulla on 25.02.13 05:50:39 CST

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points