12

I am trying to disable a McAfee Real-Time Protection service, but if I go into Services/Properties, then try to set it to Manual or Disable - it says that

unable to open service McShield for writing on Local Computer. Error 5. Access is denied.

I've tried logging in as an Admin, to no avail. I've tried resetting permissions in the registry to the key where the McAfee service is described...nothing helped. Logging in with Safe Mode did not help either.

How can I disable this service? Is there a way to disable a service before even getting into Windows?

P.S. Uninstalling McAfee is not an option.

4
  • 2
    As a side note, when you get sick and tired of McAfee, you can throughly uninstall all McAfee products once and for all with the McAfee Consumer Products Removal tool—though even then, it still leaves some files and registry entries behind. sigh. (I remember a time when McAfee was actually great; but then again it was on a 5¼" floppy…)
    – Synetech
    Jul 2, 2012 at 1:38
  • 1
    Related: How To Uninstall McAfee Antivirus Jul 16, 2016 at 0:22
  • @AngryHacker - related to your question above, but more from a technical position, i asked this question: superuser.com/questions/1595500/… and it was marked as not software related question(really???). Are there Intel/Mcafee employees censoring information on superuser ? can you vote to undelete it ? The difference from your question/answer here is related to being admin on a station without access to virusscan console.
    – thedrs
    Nov 1, 2020 at 9:18
  • @thedrs It was likely marked that because the question was more of a rant than a question. I recommend creating another question, asking specific things and keeping emotions out of it. Nov 2, 2020 at 16:40

8 Answers 8

13

Disable the option Prevent McAfee services from being stopped

(for stand alone installations of VSE 8.5i or later)

  1. Start > Programs > McAfee > VirusScan Console.

  2. Right-click Access Protection and select Properties.

  3. Deselect Prevent McAfee services from being stopped.

  4. Click Apply.

  5. Close the VirusScan Console.

3
  • 1
    and you &%£$~ downvoted this post why? these are instructions right from the McAfee website to tackle the problem at hand.
    – Molly7244
    Nov 7, 2009 at 22:39
  • 4
    @Molly: I think your answer largely duplicates mine.
    – harrymc
    Nov 8, 2009 at 14:52
  • 4
    this of course does not work if your access to deselect is disabled
    – Jakub
    Sep 4, 2013 at 19:32
18

This is how you do it if you are like me and:

  1. You are at work

  2. Running on a remotely managed SOE (including remotely managed McAfee) with Windows XP or Windows 7

  3. Have "peasant" permissions (But you need Local Admin, most users will have this)

Here's how to disable it once off: (So that it's safe to plug in an external device, note it will be back when you next reboot)

  1. Download ProcessHacker here

  2. Run ProcessHacker.exe as Adminstrator(Important! It won't work if you run it normally.) To run as admin, right-click ProcessHacker.exe and select Run as administrator.

  3. Select the following processes in the main window (if they exist) and press Delete(or right-click and select "Terminate"): Engineserver, FrameworkService, mcshield.exe, mctray.exe, mfevtps.exe, shstat.exe, udaterui.exe, vstskmgr

  4. Step 3 will knock most of them out, but a few will re-spawn like a virulent phoenix from the ash, typically: Engineserver, mfevtps, shstat, vstskmgr

  5. To kill whatever remains, find them in ProcessHackers main window and on each one individually, right-click and select "Terminator". It will display a whole list of hacky ways to try to kill the process. Leave the default options ticked, and click "Run Selected". One of the methods WILL be able to kill every remaining process.

  6. Enjoy your current session without a computer infected by this terrible antivirus. But before plugging in an external device ALWAYS double check that the above processes do not exist in ProcessHacker. They are able to be restarted remotely and by other integrated applications such as Microsoft Outlook.

To wipe it from your computer permanently:

  1. Download Unlocker" here and install. You might have to reboot. (Note it's home site seems to change frequently, but you should be able to get it all over the place, like cnet or filehippo etc.)

  2. Run all the "Once-off" steps above to disable McAfee.

  3. Using "My Computer" (or explorer whatever you want to call it) - Navigate to the McAfee installation folder which will usually be C:\Program Files\McAfee

  4. Delete everything you can.

  5. For anything that remains, right-click the files, and select the "Unlocker" option. Change the drop-down to "Delete" and press OK.

  6. If Unlocker tells you it can't delete it, but can try on reboot, tell it to do that.

  7. Once you've done this for all remaining files, you might have to reboot. When you've done this McAfee should be goneski.

  8. Make a Mojito and rest easy knowing that McAfee won't nuke that photo of you and your wife/husband from your camera ever again.

The technique here is a result of a trying a buttload of different ways to kill it, including Task Manager, Process Explorer, tskill etc. etc. It's the most reliable way I've found.

4
  • 3
    I think that this answer is by far the best answer for this question, because most people with this problem are "at work" and have only local admin rights. These steps worked for me although the Step 5 (The "Terminator" step) doesn't work all the time - it took several attempts to kill mfevtps.exe and I then had to rename it in c:\windows\system32 to stop it from restarting. Aug 20, 2013 at 12:41
  • What is meant by "Here's how to disable it once off"? What steps should I take to get to this "off" state? Jul 2, 2014 at 13:53
  • 1
    I don't find a 'Terminator' item in my Right click menu anywhere. I do fine only these two : "Terminate" and "Terminate tree". And they don't help. Most of the processes restarted after terminating from here. May 17, 2017 at 10:53
  • 1
    Maybe this used to work several years back but it doesn't now. i find it amazing that you have administrator on your computer but can't stop a mcafee process that uses all the knowledge it gained on viruses and kernel level driver to disallow you to stop it.
    – thedrs
    Oct 19, 2020 at 10:19
2

I found this regarding Mcafee Virus Scan 8.5 : How to disable McAfee Virusscan 8.5?.
I hope it's relevant to your McAfee product:

By default, the copy of Mcafee Virus Scan 8.5 comes configured to prevent Virus Scan services from being stopped. This is a safeguard against viruses stopping McAfee services and disabling Virus Scan. However, this also causes the "Disable On-Access Scan" menu item to be grayed out when right-clicking on the VShield icon in the system tray.

To turn this feature off and enable the menu item:

  • Download and install the latest version of Virus Scan 8.5 over your
    current version.
  • Right click on the VShield icon in the system tray and choose "Virus Scan Console".
  • Right click the entry for "Access Protection" and choose "Properties".
  • Uncheck the option for "Prevent McAfee services from being stopped" and click OK.
  • The "Disable On-Access Scan" menu item should now be accessible when right-clicking the VShield icon.

The latest version of Virus Scan 8.5 is necessary because it resolves a bug that prevents the menu item from being enabled even though the above option is turned off.

0
2

It seems when your enterprise uses domain authentication, ONLY domain admin can stop the service. Local admin is not authorized. bummer!! The following will prevent McAfee from starting up: Start up in windows safe Mode, locate the [Program Files]\Mcafee\VirusScan Enterprise\ directory, rename the McShield.exe and reboot into normal windows.... Et Voila... my Outlook VSTO Add-In works! Now to figure out why McAfee sees my Add-In as a threat and how to get around it...

2

The way I've been going about this and that has been working fine is to launch the services.msc console under the System account, and then stop/disable/whatever... the service from there.

To launch something under the System account I schedule a task to be run the next minute, that is:
from the console:
(let's say it's 16:29 now)
at 16:30 /interactive cmd.exe

in less than 60 seconds a new console (this time running as System) will come up. From there you can launch the services.mmc console and play with the annoying mvcshield to your will.

1
  • Can confirm this doesn't work. I can see the command prompt process is running under the SYSTEM user but I still get an access denied if I try to stop the service via command line and the stop option is disabled in the services.msc GUI
    – Ash
    Jul 24, 2021 at 8:30
1

I have found solution to disable the McAfee DLP service on my enterprise machine. So McAfee has a protection engine which prevent editing of registry, deleting of files and stopping of services.

  1. Ensure that you have Administrators rights over the system.

  2. Enter the system in Safe mode and then disable the startup of all McAfee services. It is possible to delete all system files of McAfee as well.

  3. Then enter in normal mode open regedit andremove all blocked devices from

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\hdlpctrl\DeviceBlockingRules\

0

Start > Run > services.msc > Find the Mcafee service from the list then double click it and select "disable" or "manual" from startup type...

1
  • you should read the post more thoroughly before posting your answer :)
    – Molly7244
    Nov 7, 2009 at 20:11
0

I was having serious performance issues with McAffee. I renamed McShield.exe to McShield.ex. That booger hasn't bothered me since.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.