How to disable a McAfee service?

Question

I am trying to disable a McAfee Real-Time Protection service, but if I go into Services/Properties, then try to set it to Manual or Disable - it says that

unable to open service McShield for writing on Local Computer. Error 5. Access is denied.

I've tried logging in as an Admin, to no avail. I've tried resetting permissions in the registry to the key where the McAfee service is described...nothing helped. Logging in with Safe Mode did not help either.

How can I disable this service? Is there a way to disable a service before even getting into Windows?

P.S. Uninstalling McAfee is not an option.

Answer 1

Disable the option Prevent McAfee services from being stopped

(for stand alone installations of VSE 8.5i or later)

1. Start > Programs > McAfee > VirusScan Console.

2. Right-click Access Protection and select Properties.

3. Deselect Prevent McAfee services from being stopped.

4. Click Apply.

5. Close the VirusScan Console.

Answer 2

This is how you do it if you are like me and:

1. You are at work

2. Running on a remotely managed SOE (including remotely managed McAfee) with Windows XP or Windows 7

3. Have "peasant" permissions (But you need Local Admin, most users will have this)

Here's how to disable it once off: (So that it's safe to plug in an external device, note it will be back when you next reboot)

2. Download ProcessHacker here

3. Run ProcessHacker.exe as Adminstrator(Important! It won't work if you run it normally.) To run as admin, right-click ProcessHacker.exe and select Run as administrator.

4. Select the following processes in the main window (if they exist) and press Delete(or right-click and select "Terminate"): Engineserver, FrameworkService, mcshield.exe, mctray.exe, mfevtps.exe, shstat.exe, udaterui.exe, vstskmgr

5. Step 3 will knock most of them out, but a few will re-spawn like a virulent phoenix from the ash, typically: Engineserver, mfevtps, shstat, vstskmgr

6. To kill whatever remains, find them in ProcessHackers main window and on each one individually, right-click and select "Terminator". It will display a whole list of hacky ways to try to kill the process. Leave the default options ticked, and click "Run Selected". One of the methods WILL be able to kill every remaining process.

7. Enjoy your current session without a computer infected by this terrible antivirus. But before plugging in an external device ALWAYS double check that the above processes do not exist in ProcessHacker. They are able to be restarted remotely and by other integrated applications such as Microsoft Outlook.

To wipe it from your computer permanently:

8. Download Unlocker" here and install. You might have to reboot. (Note it's home site seems to change frequently, but you should be able to get it all over the place, like cnet or filehippo etc.)

9. Run all the "Once-off" steps above to disable McAfee.

10. Using "My Computer" (or explorer whatever you want to call it) - Navigate to the McAfee installation folder which will usually be C:\Program Files\McAfee

11. Delete everything you can.

12. For anything that remains, right-click the files, and select the "Unlocker" option. Change the drop-down to "Delete" and press OK.

13. If Unlocker tells you it can't delete it, but can try on reboot, tell it to do that.

14. Once you've done this for all remaining files, you might have to reboot. When you've done this McAfee should be goneski.

15. Make a Mojito and rest easy knowing that McAfee won't nuke that photo of you and your wife/husband from your camera ever again.

The technique here is a result of a trying a buttload of different ways to kill it, including Task Manager, Process Explorer, tskill etc. etc. It's the most reliable way I've found.

Answer 3

It seems when your enterprise uses domain authentication, ONLY domain admin can stop the service. Local admin is not authorized. bummer!! The following will prevent McAfee from starting up: Start up in windows safe Mode, locate the [Program Files]\Mcafee\VirusScan Enterprise\ directory, rename the McShield.exe and reboot into normal windows.... Et Voila... my Outlook VSTO Add-In works! Now to figure out why McAfee sees my Add-In as a threat and how to get around it...

Answer 4

The way I've been going about this and that has been working fine is to launch the services.msc console under the System account, and then stop/disable/whatever... the service from there.

To launch something under the System account I schedule a task to be run the next minute, that is:
from the console:
(let's say it's 16:29 now)
at 16:30 /interactive cmd.exe

in less than 60 seconds a new console (this time running as System) will come up. From there you can launch the services.mmc console and play with the annoying mvcshield to your will.

Answer 5

I found this regarding Mcafee Virus Scan 8.5 : How to disable McAfee Virusscan 8.5?.
I hope it's relevant to your McAfee product:

By default, the copy of Mcafee Virus Scan 8.5 comes configured to prevent Virus Scan services from being stopped. This is a safeguard against viruses stopping McAfee services and disabling Virus Scan. However, this also causes the "Disable On-Access Scan" menu item to be grayed out when right-clicking on the VShield icon in the system tray.

To turn this feature off and enable the menu item:

• Download and install the latest version of Virus Scan 8.5 over your
  current version.
• Right click on the VShield icon in the system tray and choose "Virus Scan Console".
• Right click the entry for "Access Protection" and choose "Properties".
• Uncheck the option for "Prevent McAfee services from being stopped" and click OK.
• The "Disable On-Access Scan" menu item should now be accessible when right-clicking the VShield icon.

The latest version of Virus Scan 8.5 is necessary because it resolves a bug that prevents the menu item from being enabled even though the above option is turned off.

Answer 6

I have found solution to disable the McAfee DLP service on my enterprise machine. So McAfee has a protection engine which prevent editing of registry, deleting of files and stopping of services.

1. Ensure that you have Administrators rights over the system.
2. Enter the system in Safe mode and then disable the startup of all McAfee services. It is possible to delete all system files of McAfee as well.

3. Then enter in normal mode open regedit andremove all blocked devices from

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\hdlpctrl\DeviceBlockingRules\

Answer 7

I was having serious performance issues with McAffee. I renamed McShield.exe to McShield.ex. That booger hasn't bothered me since.

Answer 8

Start > Run > services.msc > Find the Mcafee service from the list then double click it and select "disable" or "manual" from startup type...