Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to disable a McAfee Real-Time Protection service, but if I go into Services/Properties, then try to set it to Manual or Disable - it says that

unable to open service McShield for writing on Local Computer. Error 5. Access is denied.

I've tried logging in as an Admin, to no avail. I've tried resetting permissions in the registry to the key where the McAfee service is described...nothing helped. Logging in with Safe Mode did not help either.

How can I disable this service? Is there a way to disable a service before even getting into Windows?

P.S. Uninstalling McAfee is not an option.

share|improve this question
1  
As a side note, when you get sick and tired of McAfee, you can throughly uninstall all McAfee products once and for all with the McAfee Consumer Products Removal tool—though even then, it still leaves some files and registry entries behind. sigh. (I remember a time when McAfee was actually great; but then again it was on a 5¼" floppy…) –  Synetech Jul 2 '12 at 1:38

7 Answers 7

up vote 11 down vote accepted

Disable the option Prevent McAfee services from being stopped

(for stand alone installations of VSE 8.5i or later)

  1. Start > Programs > McAfee > VirusScan Console.

  2. Right-click Access Protection and select Properties.

  3. Deselect Prevent McAfee services from being stopped.

  4. Click Apply.

  5. Close the VirusScan Console.

share|improve this answer
1  
and you &%£$~ downvoted this post why? these are instructions right from the McAfee website to tackle the problem at hand. –  Molly7244 Nov 7 '09 at 22:39
4  
@Molly: I think your answer largely duplicates mine. –  harrymc Nov 8 '09 at 14:52
1  
this of course does not work if your access to deselect is disabled –  Jakub Sep 4 '13 at 19:32

This is how you do it if you are like me and:

  1. You are at work

  2. Running on a remotely managed SOE (including remotely managed McAfee) with Windows XP or Windows 7

  3. Have "peasant" permissions (But you need Local Admin, most users will have this)

Here's how to disable it once off: (So that it's safe to plug in an external device, note it will be back when you next reboot)

  1. Download ProcessHacker here

  2. Run ProcessHacker.exe as Adminstrator(Important! It won't work if you run it normally.) To run as admin, right-click ProcessHacker.exe and select Run as administrator.

  3. Select the following processes in the main window (if they exist) and press Delete(or right-click and select "Terminate"): Engineserver, FrameworkService, mcshield.exe, mctray.exe, mfevtps.exe, shstat.exe, udaterui.exe, vstskmgr

  4. Step 3 will knock most of them out, but a few will re-spawn like a virulent phoenix from the ash, typically: Engineserver, mfevtps, shstat, vstskmgr

  5. To kill whatever remains, find them in ProcessHackers main window and on each one individually, right-click and select "Terminator". It will display a whole list of hacky ways to try to kill the process. Leave the default options ticked, and click "Run Selected". One of the methods WILL be able to kill every remaining process.

  6. Enjoy your current session without a computer infected by this terrible antivirus. But before plugging in an external device ALWAYS double check that the above processes do not exist in ProcessHacker. They are able to be restarted remotely and by other integrated applications such as Microsoft Outlook.

To wipe it from your computer permanently:

  1. Download Unlocker" here and install. You might have to reboot. (Note it's home site seems to change frequently, but you should be able to get it all over the place, like cnet or filehippo etc.)

  2. Run all the "Once-off" steps above to disable McAfee.

  3. Using "My Computer" (or explorer whatever you want to call it) - Navigate to the McAfee installation folder which will usually be C:\Program Files\McAfee

  4. Delete everything you can.

  5. For anything that remains, right-click the files, and select the "Unlocker" option. Change the drop-down to "Delete" and press OK.

  6. If Unlocker tells you it can't delete it, but can try on reboot, tell it to do that.

  7. Once you've done this for all remaining files, you might have to reboot. When you've done this McAfee should be goneski.

  8. Make a Mojito and rest easy knowing that McAfee won't nuke that photo of you and your wife/husband from your camera ever again.

The technique here is a result of a trying a buttload of different ways to kill it, including Task Manager, Process Explorer, tskill etc. etc. It's the most reliable way I've found.

share|improve this answer
    
I think that this answer is by far the best answer for this question, because most people with this problem are "at work" and have only local admin rights. These steps worked for me although the Step 5 (The "Terminator" step) doesn't work all the time - it took several attempts to kill mfevtps.exe and I then had to rename it in c:\windows\system32 to stop it from restarting. –  Paul Hollingsworth Aug 20 '13 at 12:41
    
What is meant by "Here's how to disable it once off"? What steps should I take to get to this "off" state? –  DeveloperDan Jul 2 at 13:53

I found this regarding Mcafee Virus Scan 8.5 : How to disable McAfee Virusscan 8.5?.
I hope it's relevant to your McAfee product:

By default, the copy of Mcafee Virus Scan 8.5 comes configured to prevent Virus Scan services from being stopped. This is a safeguard against viruses stopping McAfee services and disabling Virus Scan. However, this also causes the "Disable On-Access Scan" menu item to be grayed out when right-clicking on the VShield icon in the system tray.

To turn this feature off and enable the menu item:

  • Download and install the latest version of Virus Scan 8.5 over your
    current version.
  • Right click on the VShield icon in the system tray and choose "Virus Scan Console".
  • Right click the entry for "Access Protection" and choose "Properties".
  • Uncheck the option for "Prevent McAfee services from being stopped" and click OK.
  • The "Disable On-Access Scan" menu item should now be accessible when right-clicking the VShield icon.

The latest version of Virus Scan 8.5 is necessary because it resolves a bug that prevents the menu item from being enabled even though the above option is turned off.

share|improve this answer

It seems when your enterprise uses domain authentication, ONLY domain admin can stop the service. Local admin is not authorized. bummer!! The following will prevent McAfee from starting up: Start up in windows safe Mode, locate the [Program Files]\Mcafee\VirusScan Enterprise\ directory, rename the McShield.exe and reboot into normal windows.... Et Voila... my Outlook VSTO Add-In works! Now to figure out why McAfee sees my Add-In as a threat and how to get around it...

share|improve this answer

The way I've been going about this and that has been working fine is to launch the services.msc console under the System account, and then stop/disable/whatever... the service from there.

To launch something under the System account I schedule a task to be run the next minute, that is:
from the console:
(let's say it's 16:29 now)
at 16:30 /interactive cmd.exe

in less than 60 seconds a new console (this time running as System) will come up. From there you can launch the services.mmc console and play with the annoying mvcshield to your will.

share|improve this answer

Start > Run > services.msc > Find the Mcafee service from the list then double click it and select "disable" or "manual" from startup type...

share|improve this answer
    
you should read the post more thoroughly before posting your answer :) –  Molly7244 Nov 7 '09 at 20:11

I was having serious performance issues with McAffee. I renamed McShield.exe to McShield.ex. That booger hasn't bothered me since.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.