Weyland.be » Unlocking the McAfee Virusscan User Interface

Unlocking the McAfee Virusscan User Interface

13/12/2006 10:17 | Software | 78 replies | 58098 views | RSS

I’ve got a new flaptoy on my work, and it came pre-installed with McAfee Virusscan Enterprise 8, and with the on-asses scanner enabled. But the user interface was locked with a password, making all options unavailable.

But with a very easy registry trick, you can unlock the user interface, without knowing the password. You do need local administrative rights, and full access to the registry…

The full name of the product is “McAfee Antivirus Enterprise Edition v8.0i, but my guess is that it will be the same for other versions of McAfee…

Dig down in your registry, and browse to the following key:

HKEY_LOCAL_MACHINE\Software\Network Associated\TVD\Virusscan Enterprise\CurrentVersion

Remove the charachters from the UIP string key, and set the Dword key UIPMode to 0 (that’s a zero)

No need to reboot or anything, just enjoy your unlimited access to McAfee ;)

On 29 January 2007 at 13h13, warren wrote

Explain in detail how i remove the characters from the UIP string when it is not there n v 8.0.0? Please email me an exact remedy as I can’t get past the password or even un-install McAfee as it is “greyed out”

Cheers

Warren
On 30 January 2007 at 01h09, Selder wrote

I don’t even remember what version I have on my laptoy, I’ll take a peek tomorrow!
On 6 February 2007 at 17h06, anonymous wrote

thanks for the tip and lead. it was what i needed to know to disable the password. the access protection has been denying me to even download adobe reader 8 which really pissed me off. it took me about 1 month to figure it out that mcfee antivirus was blocking the download.

it also explains a lot about some of my other software trying to communicate with other server. anyhow thanks for the tip or lead
On 20 March 2007 at 10h31, anonymous wrote

I seem to have a problem. Once I unlock it, after some times it goes back to it’s default state… any solutions??
On 20 March 2007 at 21h54, Selder wrote

Ah, true, I noticed that too indeed, but didn’t investigate any further…
On 21 March 2007 at 00h56, anonymous wrote

How is it going? I dont know what to do when it comes to computers! So here is the problem, my dad gave me his computer because he no longer needs it. It has the McAfee installed but my dad dosent remember his password to unlock it! Can you give me a step by step to unlock the Adminstator lock code or something! I can log in because I remember my password but Im not the system adminstator! Thanks for the help!
On 15 May 2007 at 23h15, anonymous wrote

Thanx a lot. Now i’m finaly know how to disable this scanner pfff
On 15 May 2007 at 23h44, Selder wrote

Mine keeps re-enabling the password, however I think it’s the EPO service telling it to re-enable it… Doesn’t matter, I’m gonna reinstall my laptop any day now :)
On 16 June 2007 at 14h31, anonymous wrote

Great tip! Many thanks!
On 22 June 2007 at 03h39, anonymous wrote

Me too! Thanks for sharing this tip.
On 10 January 2008 at 20h43, inc wrote

hey,

thanks for the tutorial…. but there is not UIP key under current version…
i have version 8.5.0i and under current version there is another folder called TASK and it has a bunch of string under it…

please help us out…
On 11 January 2008 at 00h25, Selder wrote

I will need to install 8.5.0 on my puter to see if it uses the same technique to store the key…
On 11 January 2008 at 02h44, John Doe wrote

It does, however the registry entries are locked down by Mcaffee, and it logs your attempt to change them.
On 19 February 2008 at 22h02, anonymous butters wrote

Can you help, I have purchased a dell pc with 2 years susbcription to mcafee, unfortunately it supposed to come with downloads, but as yet Ieverytime I press the update software option, guess what, no updates, my guess is that when the option runs out in 18 months then i will have to opurchase a new anti virus and will probably beable to get all the downloads I want.
Is there anyway that I can override this system and enable mcafee to give me updates? can anyone help??

Thanks
On 19 February 2008 at 22h17, Selder wrote

Call Dell support, that’s really the only sane advise I can give you…
On 14 March 2008 at 01h07, Aaron3178 wrote

LOLOL THATS AWESOME!!

THANKS!!!!
On 18 March 2008 at 22h50, joe wrote

Thank you so much. I have been stuck with this stupid thing locked forever.
On 22 April 2008 at 05h40, Jeniver wrote

Hello, everybody! I couldn’ find such strings in my registry (version 8.5.0). Is there any way to unlock it?
On 2 June 2008 at 20h09, JFG wrote

For VirusScan 8.5.0 the location have change. Look for HKLM\SOFTWARE\McAfee\DesktopProtection

The other stuff is identical.

Enjoy!
On 6 June 2008 at 19h36, anonymous wrote

Can you help me with the step on how to reset the Password for User Interface in VirusScan Enterprise 8.5.0i…

I have tried the process for 8.5.0, but I cant find the UIP in regedit
On 6 June 2008 at 20h39, anonymous wrote

Can you help me with the step on how to reset the Password for User Interface in Mcafee VirusScan Enterprise 8.5.0i..

If not how do I uninstall it cos I have uninstalled it twice and it keeps on showing up……

Thanks
On 6 June 2008 at 22h51, Selder wrote

I did notice that the password keeps coming back, but haven’t found a solution to it… I’m no longer using McAfee now…
On 18 July 2008 at 16h56, anonymous wrote

AWESOME!!!
On 19 July 2008 at 11h53, anonymous wrote

works, thanks!
On 29 July 2008 at 15h02, mersan wrote

If the registry values keep coming back on Mcafee VirusScan Enterprise 8.5.0i just connect remotely to that computer’s registry and change it then. Worked for me. (HKLM\SOFTWARE\McAfee\DesktopProtection)
On 24 December 2008 at 13h38, thanks for inf. wrote

Thats awsome for me .I do it . İf dont work change registry values ,you must try on windows Safe Mode . thats realy work ;) U can do it …
HKLM\SOFTWARE\McAfee\DesktopProtection for 8.5.0i
On 17 January 2009 at 14h08, anonymous wrote

Great Information, I just solve my problem thanks
On 9 February 2009 at 16h31, anonymous wrote

My school laptop had the same problem and this fixes it. Thank you!
On 10 March 2009 at 04h10, anonymous wrote

it works… Thank You…
On 6 April 2009 at 11h19, anonymous wrote

It works, but after a while, it autofixes the hack. Any idea?
On 30 April 2009 at 17h00, anonymous wrote

It worked for me too but after about 15 minutes the settings get re-enabled. Any idea how to prevent this?
On 1 May 2009 at 03h56, anonymous wrote

Delete the following policies for ePolicy Orchestrator

HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8600
HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8600

This worked for me..guess it will solve the problem.
On 27 May 2009 at 18h17, anonymous wrote

Just a question, deleting policy orchestrator it disables the updates machine, is it true?
On 28 May 2009 at 21h57, TY NEDIK wrote

that is so cool
On 20 July 2009 at 09h13, anonymous wrote

Thank you for the update. It helped me a lot. Still one issue is left pending regarding the reseting of the options in registery settings.
On 31 July 2009 at 06h01, anonymous wrote

Where is the registry found?
On 4 August 2009 at 10h24, anonymous wrote

Still a little confused. I’ve deleted both viruscan8600 folders containing registry keys but when i try to edit the UIP to empy the string it comes up with “Error writing value’s new contents” Does anybody have a solution?
On 4 August 2009 at 10h27, Anonymous wrote

Ive deleted the policy ochestrator but when i try to edit UIP to make the string empty it comes up with “error writing value’s new contents”. any solutions?
On 27 August 2009 at 17h28, dee wrote

you need to stop the mcshield service before attempting to make registry changes
On 11 September 2009 at 16h49, anonymous wrote

If you get the error writing registry or something, it is probably because the Onaccess scanner blocks the registry access.
Open the virusscan console and disable the on access scanner temporarily to allow the registry modifications.
On 30 September 2009 at 15h31, anonymous wrote

legend!
On 1 October 2009 at 18h58, anonymous wrote

Well how are you supposed to Disable the service in the first place when you don’t have access to disable it? The entire menu is greyed out.
On 1 October 2009 at 19h00, anonymous wrote

Cannot disable mcshield – access is denied, also, cannot kill process from task manager – access is denied.
On 6 October 2009 at 11h00, Manu wrote

Thanks a lot it was of good help for me too
On 23 October 2009 at 13h47, anonymous wrote

Thank you! I had a different version, 8.5i, which didn’t have it located where it was it 8, under but with a search, I found UIP and UIPMode. Thanks again!
On 5 November 2009 at 01h31, soma wrote

This doesnt work…sadly :(
On 23 December 2009 at 15h44, peter wrote

how abt version 8.7..???
On 23 January 2010 at 12h26, anonymous wrote

Thanks buddy. It works for me.
On 19 February 2010 at 16h31, anonymous wrote

On a 64 bits system, the key resides in
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\DesktopProtection
Should use regedit in Safe Mode to make the change, or use a Windows Bootable CD (WinPE)
On 20 February 2010 at 01h51, Vasilis wrote

how about version 8.7????? pls help……
On 29 March 2010 at 13h21, Danson wrote

Hello! I have the same Problem as one already mentioned. Once I unlocked it, after some time it goes back to it’s default state!!?? Would be great if you could help me…and many thanx in advance
On 9 May 2010 at 17h16, anonymous wrote

need help unlock problem
On 19 May 2010 at 10h53, anonymous wrote

thank you all for the original hint and for its evolution for newer versions.
for 8.7 the registry hive is
HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection

the keys are UIP to be set to empty and UIPmode to be set to 0

i’ve created two .reg files exporting the hive, one is to set the “password off” mode and another is to set it back on. this way the password should be preserved, in case of an IT staff needs to access it. the automatism of locking again the UI might have several reasons, usually in IT managed environments this means that they have much more control on your pc than you can suspect.
On 21 May 2010 at 10h59, anonymous wrote

Tried this one in 8.7; cannot edit UIP is the message! Trying to modify the registry is logged aswell!
On 1 June 2010 at 21h17, How TO reset Mcafee Enterprise Client Password « Ibra.Me | IT For Life wrote

[...] Credits: Weyland.be: http://weyland.be/wrdprss/index.php/2006/12/13/unlocking-the-mcafee-virusscan-user-interface/ [...]
On 9 June 2010 at 20h51, anonymous wrote

Doesn’t work for me either, ver 8.7.

Cannot edit the value as per the above recommendation.
On 30 June 2010 at 09h31, anonymous wrote

Thanks man!
On 22 August 2010 at 19h53, anonymous wrote

I don´t know create a .reg, could you help me….if deactive deskprotection the updates works?
On 27 August 2010 at 18h51, anonymous wrote

Ditto on it not working for me on version 8.7
On 1 September 2010 at 19h26, anonymous wrote

el mcaffe 8.7.0i no permite copiar, reproducir etc archivo mp3 y videos
como puedo eliminar de mcaffe esta retriccion o donde la veo para cabiar cuando la requiero
el reseto de passware funciona bien (exclente)
pero necesito saber donde encuentro esta opion que restringe estos archivos
On 7 September 2010 at 22h20, Amir wrote

On 8.5 version the “error writing value’s new contents” appears each time trying to modify registery .
Trying to disable the “OnAccessScanner” but it’s grayed out.
Trying to disable the “McAfee Mcshield” with “Error 5 access is denied”
I’ve adminitrator privliges on my laptop but still it doesn’t work.
Any ideas ?
On 23 October 2010 at 20h51, anonymous wrote

thanks f0r your help guys :)
On 1 November 2010 at 16h09, anonymous wrote

My boss got me a new office pc with mcaffe on it and all of the protection on for browsing this is like one of the only websites i can enter can you please help i need to switch off all the browsing restrictoins so i can download new printer drivers
On 24 December 2010 at 02h49, anonymous wrote

hi
i got a laptop of my friend delld610 and its locked (password protected) by mcafee pinpoint and he cant remember the password is there any way passed it
thanx
On 25 January 2011 at 23h24, Darshan Patel wrote

HOW CAN i REMOVE MCAFEE with out password
On 22 March 2011 at 17h14, anonymous wrote

For everyone that this doesn’t work for, start the computer in safe mode and follow the steps again.
On 1 April 2011 at 01h43, anonymous wrote

Made these changes on a 64 bit system, started in Safe Mode, made the changes to disable the VirusScan . . . and after the reboot everything went back to the original settings.

Am I missing a step? . . . any further suggestions?
_______________________________________

“On a 64 bits system, the key resides in
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\DesktopProtection
Should use regedit in Safe Mode to make the change, or use a Windows Bootable CD (WinPE)”
On 9 May 2011 at 07h28, anonymous wrote

If erroe comes while stopping the service then run “msconfig” utility and stop the all macafee services and restart the computer. Now you can edit the registry UIP and UIPMode values.
On 9 May 2011 at 07h29, Inam ul Haq Rana wrote

If erroe comes while stopping the service then run “msconfig” utility and stop the all macafee services and restart the computer. Now you can edit the registry UIP and UIPMode values.
On 12 July 2011 at 17h53, marioaugusto wrote

Thanks.
I had to use the “msconfig” to restart in Safe-Mode, and only in that way, was possible to change the values to unlock mcafee.
ma
On 17 August 2011 at 16h14, anonymous wrote

Use with extreme caution! Making changes in the Registry can cause big problems when not done carefully.

We have McAfee VirusScan Enterprise 8.7.0i. I created a .REG file with the following in it and then “Merged” it into the registry (I actually exported. You will have to check the registry path to know where the “UIP” and “UIPMode” keys are for your install and make the appropriate modifications, but then merge the .REG file and that will turn off the UI Protection for the VirusScan Console.

McAfee_UnProtectUI.REG
—–
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection]
“UIPMode”=dword:00000000
“UIP”=”"
—–

If the values don’t update (because McAfee’s “Access Protection” is blocking the change), try running RegEdit from a different PC on your network and remotely connect to the registry of the problem machine. Good luck.

Cheers, Jim
On 17 August 2011 at 16h24, anonymous wrote

In the previous post, the quotation marks look a bit strange after I copied an pasted them there. Here is t is again:

Use with extreme caution! Making changes in the Registry can cause big problems when not done carefully.

We have McAfee VirusScan Enterprise 8.7.0i. I created a .REG file with the following in it and then “Merged” it into the registry. NOTE: I actually exported the “DesktopProtection” folder in my registry and then modified the .REG file to only contain the two keys that need to be changed … so that the syntax would be accurate.

You will have to check the registry path to know where the “UIP” and “UIPMode” keys are for your install and make the appropriate modifications but then merge the .REG file and that will turn off the UI Protection for the VirusScan Console.

McAfee_UnProtectUI.REG
—–
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection]
“UIPMode”=dword:00000000
“UIP”=”"
—–

If the values don’t update when you try to Merge (because McAfee’s “Access Protection” is blocking the change), try running RegEdit from a different PC on your network and remotely connect to the registry of the problem machine.

Cheers, Jim
On 17 August 2011 at 16h28, anonymous wrote

Must be something is happening to the quotes after I click submit. You’ll have to fix them. Each quote should be a standard double quotation mark. – Jim
On 31 August 2011 at 07h59, anonymous wrote

Many thanks to author! It works also for 8.8.
If you are not able to disable McAfee services (no permission) follow these steps:

1) Boot to Safe Mode (continually press F8 on startup)
2) run regedit – locate DesktopProtection (location depends on your version) f.e. HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection
3) change UIPMode to 0 (zero)
-if you end just with this and reboot now – unlocked McAfee will be again locked after 15 minutes because of working EPolicy Orchestrator. If you want it to be unlocked forever, follow next steps.
4) locate HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
5) right click on it – press export to backup it, save .reg file somewhere on your disc
6) again right click VIRUSCAN8600 and click delete
7) repeate steps 4,5,6 for location HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
8) restart normally
9) open virusscan console – disable OnAccess scanner and also edit properties of the OnAccess scanner and choose: general->cancel checked checkbox “Enable OnAccess scanning at startup”
10)done
On 19 October 2011 at 17h33, anonymous wrote

Many more thanks to all who have contributed… The last post above is the one that made it all work for me!!!
On 8 December 2011 at 13h10, anonymous wrote

McAfee really pisses me off as it does not let me got to site nor lets me download anything. any solutions to remove it?
On 3 February 2012 at 21h05, anonymous wrote

UNLOCK MY MCAFEE ACCOUNT
On 3 February 2012 at 21h10, anonymous wrote

TO BE HONEST I FORGOT MY PASSWORD AND I TRIED A DIFFERENT ONE WHAT I MEAN IS A NEW PASSWORD THEN IT LOCKED SO PLEASE HELP I CAN’T TO ANYTHING I CAN’T ACCESS MY ACCOUNT OR UPDATE MY ANTIVIRUS