Weyland.be » Unlocking the McAfee Virusscan User Interface

Unlocking the McAfee Virusscan User Interface

13/12/2006 10:17 | Software | 57 replies | 31393 views | RSS

I’ve got a new flaptoy on my work, and it came pre-installed with McAfee Virusscan Enterprise 8, and with the on-asses scanner enabled. But the user interface was locked with a password, making all options unavailable.

But with a very easy registry trick, you can unlock the user interface, without knowing the password. You do need local administrative rights, and full access to the registry…

The full name of the product is “McAfee Antivirus Enterprise Edition v8.0i, but my guess is that it will be the same for other versions of McAfee…

Dig down in your registry, and browse to the following key:

HKEY_LOCAL_MACHINE\Software\Network Associated\TVD\Virusscan Enterprise\CurrentVersion

Remove the charachters from the UIP string key, and set the Dword key UIPMode to 0 (that’s a zero)

No need to reboot or anything, just enjoy your unlimited access to McAfee ;)

On 29 January 2007 at 13h13, warren wrote

Explain in detail how i remove the characters from the UIP string when it is not there n v 8.0.0? Please email me an exact remedy as I can’t get past the password or even un-install McAfee as it is “greyed out”

Cheers

Warren
On 30 January 2007 at 01h09, Selder wrote

I don’t even remember what version I have on my laptoy, I’ll take a peek tomorrow!
On 6 February 2007 at 17h06, anonymous wrote

thanks for the tip and lead. it was what i needed to know to disable the password. the access protection has been denying me to even download adobe reader 8 which really pissed me off. it took me about 1 month to figure it out that mcfee antivirus was blocking the download.

it also explains a lot about some of my other software trying to communicate with other server. anyhow thanks for the tip or lead
On 20 March 2007 at 10h31, anonymous wrote

I seem to have a problem. Once I unlock it, after some times it goes back to it’s default state… any solutions??
On 20 March 2007 at 21h54, Selder wrote

Ah, true, I noticed that too indeed, but didn’t investigate any further…
On 21 March 2007 at 00h56, anonymous wrote

How is it going? I dont know what to do when it comes to computers! So here is the problem, my dad gave me his computer because he no longer needs it. It has the McAfee installed but my dad dosent remember his password to unlock it! Can you give me a step by step to unlock the Adminstator lock code or something! I can log in because I remember my password but Im not the system adminstator! Thanks for the help!
On 15 May 2007 at 23h15, anonymous wrote

Thanx a lot. Now i’m finaly know how to disable this scanner pfff
On 15 May 2007 at 23h44, Selder wrote

Mine keeps re-enabling the password, however I think it’s the EPO service telling it to re-enable it… Doesn’t matter, I’m gonna reinstall my laptop any day now :)
On 16 June 2007 at 14h31, anonymous wrote

Great tip! Many thanks!
On 22 June 2007 at 03h39, anonymous wrote

Me too! Thanks for sharing this tip.
On 10 January 2008 at 20h43, inc wrote

hey,

thanks for the tutorial…. but there is not UIP key under current version…
i have version 8.5.0i and under current version there is another folder called TASK and it has a bunch of string under it…

please help us out…
On 11 January 2008 at 00h25, Selder wrote

I will need to install 8.5.0 on my puter to see if it uses the same technique to store the key…
On 11 January 2008 at 02h44, John Doe wrote

It does, however the registry entries are locked down by Mcaffee, and it logs your attempt to change them.
On 19 February 2008 at 22h02, anonymous butters wrote

Can you help, I have purchased a dell pc with 2 years susbcription to mcafee, unfortunately it supposed to come with downloads, but as yet Ieverytime I press the update software option, guess what, no updates, my guess is that when the option runs out in 18 months then i will have to opurchase a new anti virus and will probably beable to get all the downloads I want.
Is there anyway that I can override this system and enable mcafee to give me updates? can anyone help??

Thanks
On 19 February 2008 at 22h17, Selder wrote

Call Dell support, that’s really the only sane advise I can give you…
On 14 March 2008 at 01h07, Aaron3178 wrote

LOLOL THATS AWESOME!!

THANKS!!!!
On 18 March 2008 at 22h50, joe wrote

Thank you so much. I have been stuck with this stupid thing locked forever.
On 22 April 2008 at 05h40, Jeniver wrote

Hello, everybody! I couldn’ find such strings in my registry (version 8.5.0). Is there any way to unlock it?
On 2 June 2008 at 20h09, JFG wrote

For VirusScan 8.5.0 the location have change. Look for HKLM\SOFTWARE\McAfee\DesktopProtection

The other stuff is identical.

Enjoy!
On 6 June 2008 at 19h36, anonymous wrote

Can you help me with the step on how to reset the Password for User Interface in VirusScan Enterprise 8.5.0i…

I have tried the process for 8.5.0, but I cant find the UIP in regedit
On 6 June 2008 at 20h39, anonymous wrote

Can you help me with the step on how to reset the Password for User Interface in Mcafee VirusScan Enterprise 8.5.0i..

If not how do I uninstall it cos I have uninstalled it twice and it keeps on showing up……

Thanks
On 6 June 2008 at 22h51, Selder wrote

I did notice that the password keeps coming back, but haven’t found a solution to it… I’m no longer using McAfee now…
On 18 July 2008 at 16h56, anonymous wrote

AWESOME!!!
On 19 July 2008 at 11h53, anonymous wrote

works, thanks!
On 29 July 2008 at 15h02, mersan wrote

If the registry values keep coming back on Mcafee VirusScan Enterprise 8.5.0i just connect remotely to that computer’s registry and change it then. Worked for me. (HKLM\SOFTWARE\McAfee\DesktopProtection)
On 24 December 2008 at 13h38, thanks for inf. wrote

Thats awsome for me .I do it . İf dont work change registry values ,you must try on windows Safe Mode . thats realy work ;) U can do it …
HKLM\SOFTWARE\McAfee\DesktopProtection for 8.5.0i
On 17 January 2009 at 14h08, anonymous wrote

Great Information, I just solve my problem thanks
On 9 February 2009 at 16h31, anonymous wrote

My school laptop had the same problem and this fixes it. Thank you!
On 10 March 2009 at 04h10, anonymous wrote

it works… Thank You…
On 6 April 2009 at 11h19, anonymous wrote

It works, but after a while, it autofixes the hack. Any idea?
On 30 April 2009 at 17h00, anonymous wrote

It worked for me too but after about 15 minutes the settings get re-enabled. Any idea how to prevent this?
On 1 May 2009 at 03h56, anonymous wrote

Delete the following policies for ePolicy Orchestrator

HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8600
HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8600

This worked for me..guess it will solve the problem.
On 27 May 2009 at 18h17, anonymous wrote

Just a question, deleting policy orchestrator it disables the updates machine, is it true?
On 28 May 2009 at 21h57, TY NEDIK wrote

that is so cool
On 20 July 2009 at 09h13, anonymous wrote

Thank you for the update. It helped me a lot. Still one issue is left pending regarding the reseting of the options in registery settings.
On 31 July 2009 at 06h01, anonymous wrote

Where is the registry found?
On 4 August 2009 at 10h24, anonymous wrote

Still a little confused. I’ve deleted both viruscan8600 folders containing registry keys but when i try to edit the UIP to empy the string it comes up with “Error writing value’s new contents” Does anybody have a solution?
On 4 August 2009 at 10h27, Anonymous wrote

Ive deleted the policy ochestrator but when i try to edit UIP to make the string empty it comes up with “error writing value’s new contents”. any solutions?
On 27 August 2009 at 17h28, dee wrote

you need to stop the mcshield service before attempting to make registry changes
On 11 September 2009 at 16h49, anonymous wrote

If you get the error writing registry or something, it is probably because the Onaccess scanner blocks the registry access.
Open the virusscan console and disable the on access scanner temporarily to allow the registry modifications.
On 30 September 2009 at 15h31, anonymous wrote

legend!
On 1 October 2009 at 18h58, anonymous wrote

Well how are you supposed to Disable the service in the first place when you don’t have access to disable it? The entire menu is greyed out.
On 1 October 2009 at 19h00, anonymous wrote

Cannot disable mcshield – access is denied, also, cannot kill process from task manager – access is denied.
On 6 October 2009 at 11h00, Manu wrote

Thanks a lot it was of good help for me too
On 23 October 2009 at 13h47, anonymous wrote

Thank you! I had a different version, 8.5i, which didn’t have it located where it was it 8, under but with a search, I found UIP and UIPMode. Thanks again!
On 5 November 2009 at 01h31, soma wrote

This doesnt work…sadly :(
On 23 December 2009 at 15h44, peter wrote

how abt version 8.7..???
On 23 January 2010 at 12h26, anonymous wrote

Thanks buddy. It works for me.
On 19 February 2010 at 16h31, anonymous wrote

On a 64 bits system, the key resides in
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\DesktopProtection
Should use regedit in Safe Mode to make the change, or use a Windows Bootable CD (WinPE)
On 20 February 2010 at 01h51, Vasilis wrote

how about version 8.7????? pls help……
On 29 March 2010 at 13h21, Danson wrote

Hello! I have the same Problem as one already mentioned. Once I unlocked it, after some time it goes back to it’s default state!!?? Would be great if you could help me…and many thanx in advance
On 9 May 2010 at 17h16, anonymous wrote

need help unlock problem
On 19 May 2010 at 10h53, anonymous wrote

thank you all for the original hint and for its evolution for newer versions.
for 8.7 the registry hive is
HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection

the keys are UIP to be set to empty and UIPmode to be set to 0

i’ve created two .reg files exporting the hive, one is to set the “password off” mode and another is to set it back on. this way the password should be preserved, in case of an IT staff needs to access it. the automatism of locking again the UI might have several reasons, usually in IT managed environments this means that they have much more control on your pc than you can suspect.
On 21 May 2010 at 10h59, anonymous wrote

Tried this one in 8.7; cannot edit UIP is the message! Trying to modify the registry is logged aswell!
On 1 June 2010 at 21h17, How TO reset Mcafee Enterprise Client Password « Ibra.Me | IT For Life wrote

[...] Credits: Weyland.be: http://weyland.be/wrdprss/index.php/2006/12/13/unlocking-the-mcafee-virusscan-user-interface/ [...]
On 9 June 2010 at 20h51, anonymous wrote

Doesn’t work for me either, ver 8.7.

Cannot edit the value as per the above recommendation.
On 30 June 2010 at 09h31, anonymous wrote

Thanks man!