Disabling VirusScan Enterprise during troubleshooting
If a system problem occurs that could be related to processes VirusScan Enterprise is running, you can systematically disable VirusScan Enterprise functions until the system problem is eliminated. Or, at least you can eliminate VirusScan Enterprise as the cause of the problem.
CAUTION:
You must reconfigure or restore VirusScan Enterprise to have full malware protection again after troubleshooting.
Systematically disabling the VirusScan Enterprise functionality is separated into the following eight-step process:
- Disabling Buffer Overflow protection
- Disabling Access Protection
- Disabling ScriptScan
- Disabling On Access Scanning
- Disabling On Access Scanning then reboot
- Preventing MFEVTP from loading then reboot
- Renaming mfehidk.sys then reboot
- Removing the product then reboot
Each of these eight steps is described in the following sections. For option definitions in the VirusScan Console, click Help in the interface.
Disabling buffer overflow protection
Follow these steps to disable Buffer Overflow protection.
- From the VirusScan Console Task list, right-click Buffer Overflow Protection and click Properties.
- From the Properties dialog box, deselect Enable buffer overflow protection and click OK.
- Is the original system problem fixed by disabling Buffer Overflow protection:
- Yes — Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com and search for a solution or contact McAfee Technical Support.
- No — The original system problem was probably not related to this feature.
Disabling access protection
Follow these steps to disable Access Protection.
- From the VirusScan Console Task list, double-click Access Protection to open the Access Protection Properties dialog box.
- Click Access Protection tab, deselect Enable access protection and click OK.
- Is the original system problem fixed by disabling Access Protection:
- Yes — Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com and search for a solution or contact McAfee Technical Support.
- No — The original system problem was probably not related to VirusScan Enterprise.
Disabling ScriptScan
Follow these steps to disable ScriptScan.
- From the VirusScan Console Task list, right-click On-Access Scanner to open the On-Access Scan Properties dialog box.
- Click ScriptScan tab, deselect Enable scanning of scripts and click OK.
- Is the original system problem fixed by disabling ScriptScan:
- Yes — Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com and search for a solution or contact McAfee Technical Support.
- No — The original system problem was probably not related to VirusScan Enterprise.
Disabling on-access scanning
Follow these steps to disable on access scanning.
- Disable Access Protection. From the VirusScan Console in the Task list, right-click Access Protection and select Disable.
- Change the McShield Services applet Start type to Disabled using the following:
- Click Start | Control Panel | Administrative Tools | Services to open the Services applet.
- In Services (Local), scroll down to McAfee McShield and right-click the name to open the McAfee McShield Properties dialog box.
- Click the General tab, from the Startup type list, click Disabled, and click OK.
- From the VirusScan Console Task list, right-click On-Access Scanner and click Disable from the list that appears. The On-Access Scanner icon should change to include a circle with a slash to indicate the function is disabled.
- Is the original system problem fixed by disabling On Access scanning:
- Yes — Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com and search for a solution or contact McAfee Technical Support.
- No — The original system problem was probably not related to this feature.
Disabling on-access scanning then reboot
Follow these steps to disable on access scanning and reboot.
Note: The following process assumes you have not re-enabled on access scanning after disabling it in the previous section.
- Perform a complete shut-down and reboot of the system.
- Is the original system problem fixed by disabling On Access scanning then rebooting:
- Yes — Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com and search for a solution or contact McAfee Technical Support.
- No — The original system problem was probably not related to this feature.
Preventing MFEVTP from loading then reboot
Follow these steps to prevent McAfee Validation Trust Protection Service (MFEVTP) from loading and reboot the system:
CAUTION:
This section contains information about opening or modifying the registry.
- The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
- Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986 .
- Do not run a .REG file that is not confirmed to be a genuine registry import file.
- From the command line, type regedit to display the Registry Editor user interface.
- Navigate to the following Registry: [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mfevtp]
- In the right-hand pane, right-click Start and click Modify to display the Edit DWORD Value dialog box.
- Enter 4 in Value data and click OK.
- Is the original system problem fixed by preventing MFEVTP from loading then re
booting:
- Yes — Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com and search for a solution or contact McAfee Technical Support.
- No — The original system problem was probably not related to this feature.
Renaming mfehidk.sys file then reboot
Follow these steps to rename the mfehidk.sys file and reboot the system.
- Navigate to the mfehidk.sys file in the following folder, depending on your operating system:
- For 32-bit operating systems — %windir%\System32\drivers
- For 64-bit operating systems — %windir%\System64\drivers
- Change the file name from mfehidk.sys to, for example, mfehidk.sys.saved.
- Reboot the system to stop and restart VirusScan Enterprise without loading the mfehidk.sys file.
- Is the original system problem fixed by renaming the mfehidk.sys file then rebooting:
- Yes — Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com and search for a solution or contact McAfee Technical Support.
- No — The original system problem was probably not related to VirusScan Enterprise.
Removing the product then reboot
Follow these steps to completely remove VirusScan Enterprise and reboot:.
- Remove the VirusScan Enterprise program files. Refer to the McAfee VirusScan Enterprise 8.8, Installation Guide for detailed instructions.
- Reboot the system to stop and restart the operating system without VirusScan Enterprise installed.
- Is the original system problem fixed by completely removing the VirusScan Enterprise program files and rebooting:
- Yes — The original system problem was probably related to VirusScan Enterprise.
- No — Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com and search for a solution, or contact McAfee Technical Support.