4 Replies Latest reply on Mar 1, 2010 9:02 AM by sgrimmel

    How to turn off McAfee Programatically

      I am running McAfee VirusScan Enterprise 8.7i on my Windows 7 machine.

      I am writing this utility to configure McAfee (which can do stuff like turn on McAfee, turn it off).

       

      Now how do i turn off McAfee programatically (using c++ or c#)?

      The only ways i can do it right now are :

      • Manually opening the McAfee Virusshield icon from the system tray and then selecting Exit.

      • Run a command prompt under SYSTEM account (using System internals tool psexec) and then issue the command "sc stop McShield

       

      Please suggest an option to do it!!

         

        Moved from Home Products to VirusScan Enterprise - MOD

       

       

      Message was edited by: Ex_Brit on 23/02/10 3:15:36 EST PM
        • 1. Re: How to turn off McAfee Programatically
          Attila Polinger

          Hello,

           

          What product are you using: VirusScan Enterprise 8.x ?

           

          Supposing so, I would move towards this:

           

          1. check if McAfee services can be stopped at all (that is, no VSE Access Protection rule forbids it) in the registry

          2. then use sc.exe to stop, etc. the service

           

          Sc.exe can be used - you know it-  for querying service parameters (stoppable, pausable, etc.), I would review them programatically (like "for /f.." DOS cmd) and take actions further..

           

          Was it what you had in mind?

           

          Attila

           

          PS: what did you mean by "Manually opening the McAfee VirusShield cion and selecting Exit.." ?

          • 2. Re: How to turn off McAfee Programatically

            Hi Attila,

             

              >>check if McAfee services can be stopped at all (that is, no VSE Access Protection rule forbids it) in the registry

            Where do i check for this registry key? And is it possible to change the Access Protection Rule (from an admin account)?

             

            PS : I use VSE 8.7i on Windows 7 64 bit.

            I manually open the McAfee VSE icon from the system tray and select Exit.

             

            -santhosh

            • 3. Re: How to turn off McAfee Programatically
              Attila Polinger

              Hi,

               

              see here if Access Protection is enabled(1) or not (0):

               

              HKLM\McAfee\VSCore\On Access Scanner\BehaviourBlocking - APEnabled = 1/0

               

              see here if Protect McAfee services from being stopped is enabled(1) or not(0):

               

              HKLM\McAfee\VSCore\On Access Scanner\BehaviourBlocking - PVSPTEnabled = 1/0

               

              I would expect that you'll have trouble directly disabling these regkeys, since there must be a hidden rule in VSE that only permits this for its own process (like from within VSe console).

               

              I think the VSe icon is only an interface with the product, and you should not stop any service by just exiting this interface...

               

              Attila

              • 4. Re: How to turn off McAfee Programatically

                The above is correct. VirusScan Enterprise (VSE) 8.7i has a large section dedicated to protecting the VSE software itself. While settings are protected by VSE using the registry,  opening the registry to edit its contents will not allow you to bypass the settings protecting VSE itself.

                 

                HTH