Using the same principle, as I originally used for preventing Ask Toolbar to be installed by Java, I've created a script that removes McAfee Security Scan, creates the folder MSS installs into and modify the permissions, so no one can write to it.
Copy the following code to Notepad, save it as a .cmd file and run it in an elevated command prompt:
REM Silently uninstall McAfee Security Scan (tested with 3.8)
REM and prevent future installations
REM Detect processor architecture
set proc_arch=x64
if "%PROCESSOR_ARCHITECTURE%" == "x86" (
if not defined PROCESSOR_ARCHITEW6432 set proc_arch=x86
)
REM Define McAfee Security Scan path
if "%proc_arch%" == "x86" set McAfeePath=%ProgramFiles%\McAfee Security Scan
if "%proc_arch%" == "x64" set McAfeePath=%ProgramFiles(x86)%\McAfee Security Scan
set McAfeeReadme=%McAfeePath%\..\McAfee_ReadMe.txt
set McAfeeRevert=%McAfeePath%\..\McAfee_RestorePermissions.cmd
REM Uninstall McAfee Security Scan
if exist "%McAfeePath%\uninstall.exe" start "" /wait "%McAfeePath%\uninstall.exe" /s /inner
REM Create dummy McAfee Security Scan folder
md "%McAfeePath%"
REM Add explanatory text file, as to why the dummy folder is there
echo The 'McAfee Security Scan' folder is has been created and write protected,> "%McAfeeReadme%"
echo in order to prevent McAfee Security Scan from being 'accidentally'>> "%McAfeeReadme%"
echo installed, e.g. by Adobe Reader.>> "%McAfeePath%\readme.txt">> "%McAfeeReadme%"
echo.>> "%McAfeeReadme%"
echo This has been done using ICACLS by denying write access to the>> "%McAfeeReadme%"
echo EVERYONE security group.>> "%McAfeeReadme%"
echo.>> "%McAfeeReadme%"
echo To revert permissions run:>> "%McAfeeReadme%"
echo %McAfeeRevert%>> "%McAfeeReadme%"
REM Create script to remove restrictions
echo icacls "%McAfeePath%" /remove:d *S-1-1-0> "%McAfeeRevert%"
REM Deny everyone (SID: S-1-1-0) write access
icacls "%McAfeePath%" /deny *S-1-1-0:(OI)(CI)W
Please note: ICACLS is included in Windows Vista and later. You can download ICACLS for Windows XP/Server 2003 through Microsoft KB943043 (but must first be requested, after which you will receive a link by e-mail to download it).
A similar approach can most likely be used to block most other kinds of piggybacking crapware.
Windows Explorer quirk: Access denied
Windows Explorer behaves a little strange if you try to open the folder. Even though you still have read access to the folder, Windows Explorer will tell you that access is denied, even though only write access has been denied.
This doesn't happen if you simply only have been assigned read access in the first place, but it seems to happen when you have been assigned read/write permission to the folder and then been denied write access.
Reverting permissions
The script has been updated to add a 'read me' text file and a script for removing the restriction again. Both are stored in the 32-bit program files folder.
