8

I asked about how to stop a McAfee antivirus service (where I am an administrator of the computer) in the Super User community.

Why was my question deleted as "off topic: not related to hardware/software", even though McAfee is definitely software?

I also got accused as being responsible for spreading ransomware by superuser community members. Another member gave me the great answer of "Talk to your network administrator".

Is that what we expect from Super User? That all answers should be "Talk to your network administrator"?

How do I know those moderators don't work for Intel (McAfee) and just don't want knowledge about there software to be out there? How do we manage such situations as a community of many sys-admins and not just a centrally managed censored community with too much power at the top?


Screenshot of the question:

screenshot of deleted question

| |
  • 9
    I closed it because I could see you are using Endpoint Security which (as far as i know) is a network administrated McAfee solution and even as as "administrator" on your machine you are bound by the rules of you network admin and the rules that they enforce. Per our on topic page we do not allow questions about "issues specific to corporate IT support and networks" and as a result I closed it because of that. If you had told me that this is not a problem with a software installed to protect your corporation then it could have been reopened. – Mokubai Nov 1 at 10:54
  • So you are saying any questions regarding software installed on networks are not allowed on super user ? NAS/DNS/AV/wikis/global policy configs on win... all these are out of scope for super user ? so what stackexchange community includes these ? so why don't you close: superuser.com/questions/67265/how-to-disable-a-mcafee-service/… – thedrs Nov 2 at 9:46
  • also what is the reason superuser does not allow asking about network software ? sysadmins typically work with network software, why not allow collaboration on knowledge of network software ? – thedrs Nov 2 at 9:49
  • 14
    No, I'm saying that corporate support is out of scope. If you are on a corporate network and they have installed software and limited what you can do with it then that is between you and them. If you are a part of the sysadmin community where you work then Server Fault might be where you need to go. The question you linked is a generic McAfee question and if that worked then yours should be closed as a duplicate, if it does not then it reinforces that you need to speak to your network administrator. If you have access to gpedit, NAS, and so on on your own computer then it could be on topic. – Mokubai Nov 2 at 11:44
  • 7
  • 2
    @FranckDernoncourt - The author was not accused of a crime. If anyone accuses of a crime you should flag that comment so a moderator can handle that undesired behavior – Ramhound Nov 6 at 17:50
18

Why was my question deleted as "off topic: not related to hardware/software" even though McAfee is definitely a software ?

Your question was automatically deleted due to the fact it was closed. It was closed by multiple community users, only one of those, is actually a moderator.

I got accused as being responsible for ransomware spreading by superuser community moderators. And another moderator gave me the great answer of "Talk to your network administrator".

You were never directly accused of spreading ransomware. What the user actually said, was that attempting to disable or bypass security software, is one of the methods ransomware is spread. Indicating you should talk to your IT Administrator is perfectly fine advice, it's just not an answer, which is the reason it was submitted as a comment.

How do i know those moderators don't work for Intel(McAfee) and just don't want knowledge about there software to be out there ?

Even if this was the case, McAfee does not care, if you disable their software on your machine. It also isn't true, neither of the users who voted to close your question, work for McAfee.

How do we manage such situations as a community of many system administrator and not just a centrally managed censored community with too much power at the top ?

You ask a concise question that can be answered. One of the many things that caused your question to be closed, was the statement, we should not flag it as a duplicate of an existing question. McAfee allows the users to create exclusion lists and even allows you to temporarily suspend "active" protection. However, there is a general rule, that questions asking to modify the configuration of a corporate machine is out of scope.

Security software in general is designed to be difficult to disable by the end user, this is due to the fact, if it was easy then malware would be able to do it. This is the reason you are able to temporarily suspend the protection, anything else typically, requires you to uninstall it.

| |
14

Moab isn't a moderator. I do know all the moderators and can assure you none of them work for McAfee, as far as I know

I feel like you're looking at the wrong comment - anti virus software tends to be resistant to disabling, for somewhat obvious reasons and needs a human with an admin account to do it.

You also misunderstand the comment - it says that disabling antivirus puts your employer at risk of malware or ransomware if you get hit by it, which is a legitimate concern. Even if you have local admin, if its a corporate system, as indicated by the fact its a McAfee Enterprise system, you need to ask your corporate IT support, who might have tools to let you be excluded or disable it.

How do we manage such situations as a community of many sys-admins and not just a centrally managed censored community with too much power at the top?

If there was such a situation? Ask on meta. We'll try to explain, but the biggest issue I see is simply one of communication breakdown. We don't have a McAfee mafia.

| |
  • 6
    The Symantec Yakuza however are a real problem... ;) – Burgi Nov 1 at 14:59
  • 1
    So you are saying that because AV software are the "good guys" we should never try to bypass them or ask questions about it even when they hog our machines. But when MS windows transmit a lot of user data back to their servers for bettering their software or have services that slow our machines, we should discuss ways to bypass this because MS aren't considered "good guys" ? superuser mods will decide which s/w can be questioned and bypassed and which we should not ? – thedrs Nov 2 at 9:56
  • 1
    maybe superuser should not allow adblock questions either because it is "not ethical" and hurts publishers revenue ? – thedrs Nov 2 at 10:01
  • 3
    @thedrs - Journeyman Geek at no point indicated the McAfee are the "good guys" or the "bad guys" simply that you did not understand what the comment was saying properly. Your question was flagged as being out of scope by a community user, a community moderator agreed with that flag, and as a result your question was closed. All that means is the community thought the question was out of scope. As one of those community users, I would agree with the assessment, your question was out of scope. – Ramhound Nov 2 at 17:47
  • 3
    Nope, I'm not a moderator, nor do I work for anyone, – Moab Nov 5 at 16:12
  • Well, resistance is futile 😁, as much as they try to put boulders in our way. Local admin rights is all it takes. Of course some "endpoint security" solutions are more obnoxious than others, but I haven't found a single one I wasn't able to defeat as long as I was able to obtain local admin rights and thereby impersonate SYSTEM 😉 – 0xC0000022L Nov 5 at 20:28
5

I think the other answers are great but I'd like to put the situation into a different perspective.

The main reason folks do not want to discuss ways to stopping a corporate antivirus product are because of the implications:

  1. If a way to stop the corporate security product exists from the endpoint, it bypasses deliberate engineering by the security system to implement modern security schemas such as RBAC (Role Based Access Control), TPI (Two Party Integrity), and Zero Trust. Corporate security is designed with insider threats in mind in addition to external threats. If a user is granted administrative access, they are given those rights for a specific purpose (or set of purposes) to meet the minimum required for their work. If complete control is granted, then the user is given the keys to the kingdom and nothing can stop them from engaging in prohibited activities and deleting the evidence.
  2. One of the primary goals of adversaries is to find ways to disengage security systems. If a well known method exists to disable the security system, the system is not well designed or implemented. Therefore vendors of those products take great care and go to great lengths to avoid those kinds of vulnerabilities. This is the primary reason why all of the previous SE answers to this question are no longer valid. No doubt McAfee scours the internet for questions like this and then deliberately re-designs the application to prevent those 'tips and tricks' for disabling the software.
  3. Bypassing the corporate security systems is not in the scope of this SE but more importantly is almost certainly against your corporate TOS (Terms of Service). Making modifications to the security software would definitely be frowned upon by your IT department. If they wanted you to be able to make such a change, there are settings within McAfee ePO (the control center for McAfee corporate software) that can grant the user those capabilities. You should definitely be engaging with your IT department if the McAfee software is impeding your ability to do your job. They will want to know about the issue and work towards a solution for you.

Ultimately, what you've asked for is a tutorial on how to pick a lock. While not explicitly illegal it's knowledge that is used for evil more often than not and is carefully guarded. Seek a locksmith (network admin).

| |
  • Locksmiths being real-world 'network admins' is a scary, but fairly accurate, metaphor! – Kenny Evitt Nov 6 at 23:34
  • 1
    Nothing wrong with a little lockpicking if both the lock and whatever is guarded is actually theirs. A lock at work should be handled by the corporate lockpickers. – Mast Nov 14 at 11:46
1

Many of the volunteers in this community are sysadmins or computer professionals. I am one myself. There are details to my environment, and those of every enterprise, which make it less than useful for staff we support to go about the public internet asking questions. Some of those details are interpersonal, some policy-related, and many are technical. The correct place to ask questions about the systems at your place of employment are the IT staff paid to support these.

As the person people ask questions to, I have certainly posted questions here on SuperUser, but more often on ServerFault, that I didn't yet know the answer to, in order to then use the solutions presented to solve my user's problems.

In general, this is one of the bigger reasons that I am aware of why the rule against questions about enterprise support issues is so strongly enforced.

| |
-1

First of all, your question was an XY problem. You wanted McAfee not to churn your computer during work. So you asked how to stop/kill McAfee.

Stopping McAfee could solve your immediate problem. It could bring different ones, though (by skipping files it could have detected). Other possible solutions to your problem might be:

  • IT provides you a new, more powerful computer (not something you would complain about, I guess?)
  • IT complains to McAfee / installs an update, and it no longer makes your computer unusable
  • Since that is probably due to a programmed full scan, it could be changed to a different time (they could change it globally, but it's also possible to have different sets of computers scheduled differently).
  • you might be officially told to just grab a coffee / take a walk and wait for the scan to finish... while on payroll

Plenty of options. And they do start with "Talk to your AV administrator".

| |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .