Why was I accused of spreading ransomware (and had my question deleted) for asking about stopping a McAfee service?

Question

I asked about how to stop a McAfee antivirus service (where I am an administrator of the computer) in the Super User community.

Why was my question deleted as "off topic: not related to hardware/software", even though McAfee is definitely software?

I also got accused as being responsible for spreading ransomware by superuser community members. Another member gave me the great answer of "Talk to your network administrator".

Is that what we expect from Super User? That all answers should be "Talk to your network administrator"?

How do I know those moderators don't work for Intel (McAfee) and just don't want knowledge about there software to be out there? How do we manage such situations as a community of many sys-admins and not just a centrally managed censored community with too much power at the top?

---

Screenshot of the question:

Answer 1

Why was my question deleted as "off topic: not related to hardware/software" even though McAfee is definitely a software ?

Your question was automatically deleted due to the fact it was closed. It was closed by multiple community users, only one of those, is actually a moderator.

I got accused as being responsible for ransomware spreading by superuser community moderators. And another moderator gave me the great answer of "Talk to your network administrator".

You were never directly accused of spreading ransomware. What the user actually said, was that attempting to disable or bypass security software, is one of the methods ransomware is spread. Indicating you should talk to your IT Administrator is perfectly fine advice, it's just not an answer, which is the reason it was submitted as a comment.

How do i know those moderators don't work for Intel(McAfee) and just don't want knowledge about there software to be out there ?

Even if this was the case, McAfee does not care, if you disable their software on your machine. It also isn't true, neither of the users who voted to close your question, work for McAfee.

How do we manage such situations as a community of many system administrator and not just a centrally managed censored community with too much power at the top ?

You ask a concise question that can be answered. One of the many things that caused your question to be closed, was the statement, we should not flag it as a duplicate of an existing question. McAfee allows the users to create exclusion lists and even allows you to temporarily suspend "active" protection. However, there is a general rule, that questions asking to modify the configuration of a corporate machine is out of scope.

Security software in general is designed to be difficult to disable by the end user, this is due to the fact, if it was easy then malware would be able to do it. This is the reason you are able to temporarily suspend the protection, anything else typically, requires you to uninstall it.

Answer 2

Moab isn't a moderator. I do know all the moderators and can assure you none of them work for McAfee, as far as I know

I feel like you're looking at the wrong comment - anti virus software tends to be resistant to disabling, for somewhat obvious reasons and needs a human with an admin account to do it.

You also misunderstand the comment - it says that disabling antivirus puts your employer at risk of malware or ransomware if you get hit by it, which is a legitimate concern. Even if you have local admin, if its a corporate system, as indicated by the fact its a McAfee Enterprise system, you need to ask your corporate IT support, who might have tools to let you be excluded or disable it.

How do we manage such situations as a community of many sys-admins and not just a centrally managed censored community with too much power at the top?

If there was such a situation? Ask on meta. We'll try to explain, but the biggest issue I see is simply one of communication breakdown. We don't have a McAfee mafia.

Answer 3

I think the other answers are great but I'd like to put the situation into a different perspective.

The main reason folks do not want to discuss ways to stopping a corporate antivirus product are because of the implications:

1. If a way to stop the corporate security product exists from the endpoint, it bypasses deliberate engineering by the security system to implement modern security schemas such as RBAC (Role Based Access Control), TPI (Two Party Integrity), and Zero Trust. Corporate security is designed with insider threats in mind in addition to external threats. If a user is granted administrative access, they are given those rights for a specific purpose (or set of purposes) to meet the minimum required for their work. If complete control is granted, then the user is given the keys to the kingdom and nothing can stop them from engaging in prohibited activities and deleting the evidence.
2. One of the primary goals of adversaries is to find ways to disengage security systems. If a well known method exists to disable the security system, the system is not well designed or implemented. Therefore vendors of those products take great care and go to great lengths to avoid those kinds of vulnerabilities. This is the primary reason why all of the previous SE answers to this question are no longer valid. No doubt McAfee scours the internet for questions like this and then deliberately re-designs the application to prevent those 'tips and tricks' for disabling the software.
3. Bypassing the corporate security systems is not in the scope of this SE but more importantly is almost certainly against your corporate TOS (Terms of Service). Making modifications to the security software would definitely be frowned upon by your IT department. If they wanted you to be able to make such a change, there are settings within McAfee ePO (the control center for McAfee corporate software) that can grant the user those capabilities. You should definitely be engaging with your IT department if the McAfee software is impeding your ability to do your job. They will want to know about the issue and work towards a solution for you.

Ultimately, what you've asked for is a tutorial on how to pick a lock. While not explicitly illegal it's knowledge that is used for evil more often than not and is carefully guarded. Seek a locksmith (network admin).

Answer 4

Many of the volunteers in this community are sysadmins or computer professionals. I am one myself. There are details to my environment, and those of every enterprise, which make it less than useful for staff we support to go about the public internet asking questions. Some of those details are interpersonal, some policy-related, and many are technical. The correct place to ask questions about the systems at your place of employment are the IT staff paid to support these.

As the person people ask questions to, I have certainly posted questions here on SuperUser, but more often on ServerFault, that I didn't yet know the answer to, in order to then use the solutions presented to solve my user's problems.

In general, this is one of the bigger reasons that I am aware of why the rule against questions about enterprise support issues is so strongly enforced.

Answer 5

First of all, your question was an XY problem. You wanted McAfee not to churn your computer during work. So you asked how to stop/kill McAfee.

Stopping McAfee could solve your immediate problem. It could bring different ones, though (by skipping files it could have detected). Other possible solutions to your problem might be:

• IT provides you a new, more powerful computer (not something you would complain about, I guess?)
• IT complains to McAfee / installs an update, and it no longer makes your computer unusable
• Since that is probably due to a programmed full scan, it could be changed to a different time (they could change it globally, but it's also possible to have different sets of computers scheduled differently).
• you might be officially told to just grab a coffee / take a walk and wait for the scan to finish... while on payroll

Plenty of options. And they do start with "Talk to your AV administrator".