How to use Access Protection policies to protect against viruses that can disable Task Manager

Technical Articles ID: KB53355
Last Modified: 7/22/2020

Environment

McAfee VirusScan Enterprise (VSE) 8.8

For details of VirusScan Enterprise supported platforms, see KB51111.

Summary

Several viruses can disable administrative features of the computer such as Task Manager. When the features as disabled, Task Manager is shown as unavailable if you try to load it by right-clicking the taskbar.

This article explains how VirusScan can be used to prevent from administrative features being disabled.

Solution

IMPORTANT: These instructions directly affect your access to the registry. It can be circumvented by (temporarily) disabling Access Protection.

To protect Task Manager

Click Start, Programs, McAfee, VirusScan Console.
Double-click Access Protection.
From Categories, select User-Defined Rules, New.
Select Registry Blocking Rule and click OK.
For the Rule name type Prevent modification of Task Manager - 1.
For Processes to include, type asterisk (*).
It means that all processes are included.
For Processes to exclude, type gpupdate.exe and any other process to be excluded, separating processes by a comma and a space.
The gpupdate.exe process is the Microsoft Group Policy Refresh Utility. See http://technet.microsoft.com/en-us/library/bb490983.aspx
Under Registry Key or value to protect, select HKCU from the drop-down list.
In the adjacent field, type /Software/Microsoft/Windows/CurrentVersion/Policies/System/DisableTaskMgr
For Rule Type, select Value.
For Registry actions to block select Write to key or value and Create Key or value. Click OK.
The rule created above protects the HKCU (HKEY_CURRENT_USER) registry Hive. A similar rule must be created for the HKLM (HKEY_LOCAL_MACHINE) Hive.
Repeat these steps, naming the rule Prevent modification of Task Manager - 2 and selecting HKLM instead of HKCU.

Related Information

Previous Document ID

616141

Affected Products

VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

How to use Access Protection policies to protect against viruses that can disable Task Manager

Environment

Summary

Solution

Related Information

Previous Document ID

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

How to use Access Protection policies to protect against viruses that can disable Task Manager

Environment

Summary

Solution

Related Information

Previous Document ID

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title