How to disable a McAfee service?
This is how you do it if you are like me and:
You are at work
Running on a remotely managed SOE (including remotely managed McAfee) with Windows XP or Windows 7
Have "peasant" permissions (But you need Local Admin, most users will have this)
Here's how to disable it once off: (So that it's safe to plug in an external device, note it will be back when you next reboot)
Download ProcessHacker here
Run ProcessHacker.exe as Adminstrator(Important! It won't work if you run it normally.) To run as admin, right-click ProcessHacker.exe and select
Run as administrator.Select the following processes in the main window (if they exist) and press Delete(or right-click and select "Terminate"): Engineserver, FrameworkService, mcshield.exe, mctray.exe, mfevtps.exe, shstat.exe, udaterui.exe, vstskmgr
Step 3 will knock most of them out, but a few will re-spawn like a virulent phoenix from the ash, typically: Engineserver, mfevtps, shstat, vstskmgr
To kill whatever remains, find them in ProcessHackers main window and on each one individually, right-click and select "Terminator". It will display a whole list of hacky ways to try to kill the process. Leave the default options ticked, and click "Run Selected". One of the methods WILL be able to kill every remaining process.
Enjoy your current session without a computer infected by this terrible antivirus. But before plugging in an external device ALWAYS double check that the above processes do not exist in ProcessHacker. They are able to be restarted remotely and by other integrated applications such as Microsoft Outlook.
To wipe it from your computer permanently:
Download Unlocker" here and install. You might have to reboot. (Note it's home site seems to change frequently, but you should be able to get it all over the place, like cnet or filehippo etc.)
Run all the "Once-off" steps above to disable McAfee.
Using "My Computer" (or explorer whatever you want to call it) - Navigate to the McAfee installation folder which will usually be C:\Program Files\McAfee
Delete everything you can.
For anything that remains, right-click the files, and select the "Unlocker" option. Change the drop-down to "Delete" and press OK.
If Unlocker tells you it can't delete it, but can try on reboot, tell it to do that.
Once you've done this for all remaining files, you might have to reboot. When you've done this McAfee should be goneski.
Make a Mojito and rest easy knowing that McAfee won't nuke that photo of you and your wife/husband from your camera ever again.
The technique here is a result of a trying a buttload of different ways to kill it, including Task Manager, Process Explorer, tskill etc. etc. It's the most reliable way I've found.
Disable the option Prevent McAfee services from being stopped
(for stand alone installations of VSE 8.5i or later)
Start > Programs > McAfee > VirusScan Console.
Right-click Access Protection and select Properties.
Deselect Prevent McAfee services from being stopped.
Click Apply.
Close the VirusScan Console.
I found this regarding Mcafee Virus Scan 8.5 : How to disable McAfee Virusscan 8.5?.
I hope it's relevant to your McAfee product:
By default, the copy of Mcafee Virus Scan 8.5 comes configured to prevent Virus Scan services from being stopped. This is a safeguard against viruses stopping McAfee services and disabling Virus Scan. However, this also causes the "Disable On-Access Scan" menu item to be grayed out when right-clicking on the VShield icon in the system tray.
To turn this feature off and enable the menu item:
- Download and install the latest version of Virus Scan 8.5 over your
current version.- Right click on the VShield icon in the system tray and choose "Virus Scan Console".
- Right click the entry for "Access Protection" and choose "Properties".
- Uncheck the option for "Prevent McAfee services from being stopped" and click OK.
- The "Disable On-Access Scan" menu item should now be accessible when right-clicking the VShield icon.
The latest version of Virus Scan 8.5 is necessary because it resolves a bug that prevents the menu item from being enabled even though the above option is turned off.