Unlocking the McAfee Virusscan User Interface

13/12/2006 10:17 | Software | 82 replies | 88823 views | RSS

I’ve got a new flaptoy on my work, and it came pre-installed with McAfee Virusscan Enterprise 8, and with the on-asses scanner enabled. But the user interface was locked with a password, making all options unavailable.

But with a very easy registry trick, you can unlock the user interface, without knowing the password. You do need local administrative rights, and full access to the registry…

The full name of the product is “McAfee Antivirus Enterprise Edition v8.0i, but my guess is that it will be the same for other versions of McAfee…

Dig down in your registry, and browse to the following key:

HKEY_LOCAL_MACHINE\Software\Network Associated\TVD\Virusscan Enterprise\CurrentVersion

Remove the charachters from the UIP string key, and set the Dword key UIPMode to 0 (that’s a zero)

No need to reboot or anything, just enjoy your unlimited access to McAfee ;)


  1. On 29 January 2007 at 13h13, warren wrote

    Explain in detail how i remove the characters from the UIP string when it is not there n v 8.0.0? Please email me an exact remedy as I can’t get past the password or even un-install McAfee as it is “greyed out”

    Cheers

    Warren

  2. On 30 January 2007 at 01h09, Selder wrote

    I don’t even remember what version I have on my laptoy, I’ll take a peek tomorrow!

  3. On 6 February 2007 at 17h06, anonymous wrote

    thanks for the tip and lead. it was what i needed to know to disable the password. the access protection has been denying me to even download adobe reader 8 which really pissed me off. it took me about 1 month to figure it out that mcfee antivirus was blocking the download.

    it also explains a lot about some of my other software trying to communicate with other server. anyhow thanks for the tip or lead

  4. On 20 March 2007 at 10h31, anonymous wrote

    I seem to have a problem. Once I unlock it, after some times it goes back to it’s default state… any solutions??

  5. On 20 March 2007 at 21h54, Selder wrote

    Ah, true, I noticed that too indeed, but didn’t investigate any further…

  6. On 21 March 2007 at 00h56, anonymous wrote

    How is it going? I dont know what to do when it comes to computers! So here is the problem, my dad gave me his computer because he no longer needs it. It has the McAfee installed but my dad dosent remember his password to unlock it! Can you give me a step by step to unlock the Adminstator lock code or something! I can log in because I remember my password but Im not the system adminstator! Thanks for the help!

  7. On 15 May 2007 at 23h15, anonymous wrote

    Thanx a lot. Now i’m finaly know how to disable this scanner pfff

  8. On 15 May 2007 at 23h44, Selder wrote

    Mine keeps re-enabling the password, however I think it’s the EPO service telling it to re-enable it… Doesn’t matter, I’m gonna reinstall my laptop any day now :)

  9. On 16 June 2007 at 14h31, anonymous wrote

    Great tip! Many thanks!

  10. On 22 June 2007 at 03h39, anonymous wrote

    Me too! Thanks for sharing this tip.

  11. On 10 January 2008 at 20h43, inc wrote

    hey,

    thanks for the tutorial…. but there is not UIP key under current version…
    i have version 8.5.0i and under current version there is another folder called TASK and it has a bunch of string under it…

    please help us out…

  12. On 11 January 2008 at 00h25, Selder wrote

    I will need to install 8.5.0 on my puter to see if it uses the same technique to store the key…

  13. On 11 January 2008 at 02h44, John Doe wrote

    It does, however the registry entries are locked down by Mcaffee, and it logs your attempt to change them.

  14. On 19 February 2008 at 22h02, anonymous butters wrote

    Can you help, I have purchased a dell pc with 2 years susbcription to mcafee, unfortunately it supposed to come with downloads, but as yet Ieverytime I press the update software option, guess what, no updates, my guess is that when the option runs out in 18 months then i will have to opurchase a new anti virus and will probably beable to get all the downloads I want.
    Is there anyway that I can override this system and enable mcafee to give me updates? can anyone help??

    Thanks

  15. On 19 February 2008 at 22h17, Selder wrote

    Call Dell support, that’s really the only sane advise I can give you…

  16. On 14 March 2008 at 01h07, Aaron3178 wrote

    LOLOL THATS AWESOME!!

    THANKS!!!!

  17. On 18 March 2008 at 22h50, joe wrote

    Thank you so much. I have been stuck with this stupid thing locked forever.

  18. On 22 April 2008 at 05h40, Jeniver wrote

    Hello, everybody! I couldn’ find such strings in my registry (version 8.5.0). Is there any way to unlock it?

  19. On 2 June 2008 at 20h09, JFG wrote

    For VirusScan 8.5.0 the location have change. Look for HKLM\SOFTWARE\McAfee\DesktopProtection

    The other stuff is identical.

    Enjoy!

  20. On 6 June 2008 at 19h36, anonymous wrote

    Can you help me with the step on how to reset the Password for User Interface in VirusScan Enterprise 8.5.0i…

    I have tried the process for 8.5.0, but I cant find the UIP in regedit

  21. On 6 June 2008 at 20h39, anonymous wrote

    Can you help me with the step on how to reset the Password for User Interface in Mcafee VirusScan Enterprise 8.5.0i..

    If not how do I uninstall it cos I have uninstalled it twice and it keeps on showing up……

    Thanks

  22. On 6 June 2008 at 22h51, Selder wrote

    I did notice that the password keeps coming back, but haven’t found a solution to it… I’m no longer using McAfee now…

  23. On 18 July 2008 at 16h56, anonymous wrote

    AWESOME!!!

  24. On 19 July 2008 at 11h53, anonymous wrote

    works, thanks!

  25. On 29 July 2008 at 15h02, mersan wrote

    If the registry values keep coming back on Mcafee VirusScan Enterprise 8.5.0i just connect remotely to that computer’s registry and change it then. Worked for me. (HKLM\SOFTWARE\McAfee\DesktopProtection)

  26. On 24 December 2008 at 13h38, thanks for inf. wrote

    Thats awsome for me .I do it . İf dont work change registry values ,you must try on windows Safe Mode . thats realy work ;) U can do it …
    HKLM\SOFTWARE\McAfee\DesktopProtection for 8.5.0i

  27. On 17 January 2009 at 14h08, anonymous wrote

    Great Information, I just solve my problem thanks

  28. On 9 February 2009 at 16h31, anonymous wrote

    My school laptop had the same problem and this fixes it. Thank you!

  29. On 10 March 2009 at 04h10, anonymous wrote

    it works… Thank You…

  30. On 6 April 2009 at 11h19, anonymous wrote

    It works, but after a while, it autofixes the hack. Any idea?

  31. On 30 April 2009 at 17h00, anonymous wrote

    It worked for me too but after about 15 minutes the settings get re-enabled. Any idea how to prevent this?

  32. On 1 May 2009 at 03h56, anonymous wrote

    Delete the following policies for ePolicy Orchestrator

    HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8600
    HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8600

    This worked for me..guess it will solve the problem.

  33. On 27 May 2009 at 18h17, anonymous wrote

    Just a question, deleting policy orchestrator it disables the updates machine, is it true?

  34. On 28 May 2009 at 21h57, TY NEDIK wrote

    that is so cool

  35. On 20 July 2009 at 09h13, anonymous wrote

    Thank you for the update. It helped me a lot. Still one issue is left pending regarding the reseting of the options in registery settings.

  36. On 31 July 2009 at 06h01, anonymous wrote

    Where is the registry found?

  37. On 4 August 2009 at 10h24, anonymous wrote

    Still a little confused. I’ve deleted both viruscan8600 folders containing registry keys but when i try to edit the UIP to empy the string it comes up with “Error writing value’s new contents” Does anybody have a solution?

  38. On 4 August 2009 at 10h27, Anonymous wrote

    Ive deleted the policy ochestrator but when i try to edit UIP to make the string empty it comes up with “error writing value’s new contents”. any solutions?

  39. On 27 August 2009 at 17h28, dee wrote

    you need to stop the mcshield service before attempting to make registry changes

  40. On 11 September 2009 at 16h49, anonymous wrote

    If you get the error writing registry or something, it is probably because the Onaccess scanner blocks the registry access.
    Open the virusscan console and disable the on access scanner temporarily to allow the registry modifications.

  41. On 30 September 2009 at 15h31, anonymous wrote

    legend!

  42. On 1 October 2009 at 18h58, anonymous wrote

    Well how are you supposed to Disable the service in the first place when you don’t have access to disable it? The entire menu is greyed out.

  43. On 1 October 2009 at 19h00, anonymous wrote

    Cannot disable mcshield – access is denied, also, cannot kill process from task manager – access is denied.

  44. On 6 October 2009 at 11h00, Manu wrote

    Thanks a lot it was of good help for me too

  45. On 23 October 2009 at 13h47, anonymous wrote

    Thank you! I had a different version, 8.5i, which didn’t have it located where it was it 8, under but with a search, I found UIP and UIPMode. Thanks again!

  46. On 5 November 2009 at 01h31, soma wrote

    This doesnt work…sadly :(

  47. On 23 December 2009 at 15h44, peter wrote

    how abt version 8.7..???

  48. On 23 January 2010 at 12h26, anonymous wrote

    Thanks buddy. It works for me.

  49. On 19 February 2010 at 16h31, anonymous wrote

    On a 64 bits system, the key resides in
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\DesktopProtection
    Should use regedit in Safe Mode to make the change, or use a Windows Bootable CD (WinPE)

  50. On 20 February 2010 at 01h51, Vasilis wrote

    how about version 8.7????? pls help……

  51. On 29 March 2010 at 13h21, Danson wrote

    Hello! I have the same Problem as one already mentioned. Once I unlocked it, after some time it goes back to it’s default state!!?? Would be great if you could help me…and many thanx in advance

  52. On 9 May 2010 at 17h16, anonymous wrote

    need help unlock problem

  53. On 19 May 2010 at 10h53, anonymous wrote

    thank you all for the original hint and for its evolution for newer versions.
    for 8.7 the registry hive is
    HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection

    the keys are UIP to be set to empty and UIPmode to be set to 0

    i’ve created two .reg files exporting the hive, one is to set the “password off” mode and another is to set it back on. this way the password should be preserved, in case of an IT staff needs to access it. the automatism of locking again the UI might have several reasons, usually in IT managed environments this means that they have much more control on your pc than you can suspect.

  54. On 21 May 2010 at 10h59, anonymous wrote

    Tried this one in 8.7; cannot edit UIP is the message! Trying to modify the registry is logged aswell!

  55. [...] Credits: Weyland.be: http://weyland.be/wrdprss/index.php/2006/12/13/unlocking-the-mcafee-virusscan-user-interface/ [...]

  56. On 9 June 2010 at 20h51, anonymous wrote

    Doesn’t work for me either, ver 8.7.

    Cannot edit the value as per the above recommendation.

  57. On 30 June 2010 at 09h31, anonymous wrote

    Thanks man!

  58. On 22 August 2010 at 19h53, anonymous wrote

    I don´t know create a .reg, could you help me….if deactive deskprotection the updates works?

  59. On 27 August 2010 at 18h51, anonymous wrote

    Ditto on it not working for me on version 8.7

  60. On 1 September 2010 at 19h26, anonymous wrote

    el mcaffe 8.7.0i no permite copiar, reproducir etc archivo mp3 y videos
    como puedo eliminar de mcaffe esta retriccion o donde la veo para cabiar cuando la requiero
    el reseto de passware funciona bien (exclente)
    pero necesito saber donde encuentro esta opion que restringe estos archivos

  61. On 7 September 2010 at 22h20, Amir wrote

    On 8.5 version the “error writing value’s new contents” appears each time trying to modify registery .
    Trying to disable the “OnAccessScanner” but it’s grayed out.
    Trying to disable the “McAfee Mcshield” with “Error 5 access is denied”
    I’ve adminitrator privliges on my laptop but still it doesn’t work.
    Any ideas ?

  62. On 23 October 2010 at 20h51, anonymous wrote

    thanks f0r your help guys :)

  63. On 1 November 2010 at 16h09, anonymous wrote

    My boss got me a new office pc with mcaffe on it and all of the protection on for browsing this is like one of the only websites i can enter can you please help i need to switch off all the browsing restrictoins so i can download new printer drivers

  64. On 24 December 2010 at 02h49, anonymous wrote

    hi
    i got a laptop of my friend delld610 and its locked (password protected) by mcafee pinpoint and he cant remember the password is there any way passed it
    thanx

  65. On 25 January 2011 at 23h24, Darshan Patel wrote

    HOW CAN i REMOVE MCAFEE with out password

  66. On 22 March 2011 at 17h14, anonymous wrote

    For everyone that this doesn’t work for, start the computer in safe mode and follow the steps again.

  67. On 1 April 2011 at 01h43, anonymous wrote

    Made these changes on a 64 bit system, started in Safe Mode, made the changes to disable the VirusScan . . . and after the reboot everything went back to the original settings.

    Am I missing a step? . . . any further suggestions?
    _______________________________________

    “On a 64 bits system, the key resides in
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\DesktopProtection
    Should use regedit in Safe Mode to make the change, or use a Windows Bootable CD (WinPE)”

  68. On 9 May 2011 at 07h28, anonymous wrote

    If erroe comes while stopping the service then run “msconfig” utility and stop the all macafee services and restart the computer. Now you can edit the registry UIP and UIPMode values.

  69. On 9 May 2011 at 07h29, Inam ul Haq Rana wrote

    If erroe comes while stopping the service then run “msconfig” utility and stop the all macafee services and restart the computer. Now you can edit the registry UIP and UIPMode values.

  70. On 12 July 2011 at 17h53, marioaugusto wrote

    Thanks.
    I had to use the “msconfig” to restart in Safe-Mode, and only in that way, was possible to change the values to unlock mcafee.
    ma

  71. On 17 August 2011 at 16h14, anonymous wrote

    Use with extreme caution! Making changes in the Registry can cause big problems when not done carefully.

    We have McAfee VirusScan Enterprise 8.7.0i. I created a .REG file with the following in it and then “Merged” it into the registry (I actually exported. You will have to check the registry path to know where the “UIP” and “UIPMode” keys are for your install and make the appropriate modifications, but then merge the .REG file and that will turn off the UI Protection for the VirusScan Console.

    McAfee_UnProtectUI.REG
    —–
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection]
    “UIPMode”=dword:00000000
    “UIP”=”"
    —–

    If the values don’t update (because McAfee’s “Access Protection” is blocking the change), try running RegEdit from a different PC on your network and remotely connect to the registry of the problem machine. Good luck.

    Cheers, Jim

  72. On 17 August 2011 at 16h24, anonymous wrote

    In the previous post, the quotation marks look a bit strange after I copied an pasted them there. Here is t is again:

    Use with extreme caution! Making changes in the Registry can cause big problems when not done carefully.

    We have McAfee VirusScan Enterprise 8.7.0i. I created a .REG file with the following in it and then “Merged” it into the registry. NOTE: I actually exported the “DesktopProtection” folder in my registry and then modified the .REG file to only contain the two keys that need to be changed … so that the syntax would be accurate.

    You will have to check the registry path to know where the “UIP” and “UIPMode” keys are for your install and make the appropriate modifications but then merge the .REG file and that will turn off the UI Protection for the VirusScan Console.

    McAfee_UnProtectUI.REG
    —–
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection]
    “UIPMode”=dword:00000000
    “UIP”=”"
    —–

    If the values don’t update when you try to Merge (because McAfee’s “Access Protection” is blocking the change), try running RegEdit from a different PC on your network and remotely connect to the registry of the problem machine.

    Cheers, Jim

  73. On 17 August 2011 at 16h28, anonymous wrote

    Must be something is happening to the quotes after I click submit. You’ll have to fix them. Each quote should be a standard double quotation mark. – Jim

  74. On 31 August 2011 at 07h59, anonymous wrote

    Many thanks to author! It works also for 8.8.
    If you are not able to disable McAfee services (no permission) follow these steps:

    1) Boot to Safe Mode (continually press F8 on startup)
    2) run regedit – locate DesktopProtection (location depends on your version) f.e. HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection
    3) change UIPMode to 0 (zero)
    -if you end just with this and reboot now – unlocked McAfee will be again locked after 15 minutes because of working EPolicy Orchestrator. If you want it to be unlocked forever, follow next steps.
    4) locate HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
    5) right click on it – press export to backup it, save .reg file somewhere on your disc
    6) again right click VIRUSCAN8600 and click delete
    7) repeate steps 4,5,6 for location HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
    8) restart normally
    9) open virusscan console – disable OnAccess scanner and also edit properties of the OnAccess scanner and choose: general->cancel checked checkbox “Enable OnAccess scanning at startup”
    10)done

  75. On 19 October 2011 at 17h33, anonymous wrote

    Many more thanks to all who have contributed… The last post above is the one that made it all work for me!!!

  76. On 8 December 2011 at 13h10, anonymous wrote

    McAfee really pisses me off as it does not let me got to site nor lets me download anything. any solutions to remove it?

  77. On 3 February 2012 at 21h05, anonymous wrote

    UNLOCK MY MCAFEE ACCOUNT

  78. On 3 February 2012 at 21h10, anonymous wrote

    TO BE HONEST I FORGOT MY PASSWORD AND I TRIED A DIFFERENT ONE WHAT I MEAN IS A NEW PASSWORD THEN IT LOCKED SO PLEASE HELP I CAN’T TO ANYTHING I CAN’T ACCESS MY ACCOUNT OR UPDATE MY ANTIVIRUS

  79. On 26 June 2012 at 09h14, Mehdi wrote

    How to disable mcafee data loss prevention 2012 in client Computers?

  80. On 7 July 2012 at 11h01, anonymous wrote

    THIS ACTUALLY WORKS. THANKS EVERYONE!!

  81. On 1 November 2012 at 20h39, Petey wrote

    I have McAfee Enterprise 8.5.0
    I started the laptop under test in SafeMode
    Logged in as administrator
    Opened REGEDIT
    Modified the following files:
    HKLM\SOFTWARE\McAfee\DesktopProtection\UIP (changed to blank)
    HKLM\SOFTWARE\McAfee\DesktopProtection\UIPMode (changed to 0)

    After reboot, the VirusScan Console was unlocked and no password existed.

  82. [...] at the next polling of ePolicy Orchestrator. A typical interval maybe five minutes. However, an article that tackles an earlier version inspired this [...]