(Partially) OT: Circumventing NAVCE (was: Performance Issues due to Anti-Virus software.)

["Max Bowsher" <maxb at ukf dot net>]

Igor Pechtchanski wrote:
> Dan,
> "Good luck" is the exact term needed here, in reference to turning off NAV
> Corp. Edition.  The service runs as LocalSystem, so anyone with less
> privilege than that is not able to either turn it off or change anything
> that is not unlocked.  The way it's set up on my computer, the option to
> stop the scan is disabled, and the scheduler is locked.  Since the process
> runs as LocalSystem as well, it is unkillable through the Task Manager.
> I'm of half a mind to set up an ssh server just to be able to su to local
> system and kill it.  But for now I live with it.
> Igor

The pasted REGEDIT file shows how to regain control control of NAVCE. Of course,
you will need local admin to edit the relevant registry locations. I can't say
for certain that your version of NAVCE will use _exactly_ the same registry
keys, but with this as a hint, it shouldn't take more than 5 minutes for anyone
comfortable with registry editing to unlock NAVCE.

Max.


REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\LocalSca
ns\ClientServerScheduledScan_1]
"ScanLocked"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\Administ
ratorOnly\Security]
"LockUnloadServices"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\Storages
\Filesystem\RealTimeScan]
"OnOff-L"=dword:00000000
"MessageBox-L"=dword:00000000
"BackupToQuarantine-L"=dword:00000000
"Writes-L"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\Storages
\LotusNotes\RealTimeScan]
"FileType-L"=dword:00000000
"MessageBox-L"=dword:00000000
"NotifySender-L"=dword:00000000
"NotifySelected-L"=dword:00000000
"InsertWarning-L"=dword:00000000


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/