Loading...

Knowledge Center

The Windows "Run" registry key gets deleted if Application Control / Change Control 6.1.1 is uninstalled
Technical Articles ID:   KB79793
Last Modified:  1/15/2014

Environment

McAfee Application Control 6.1.1
McAfee Change Control 6.1.1

 

Summary

This article is intended to educate customers about an issue with MAC / MCC uninstallation.

Problem

The following Windows registry gets deleted if MAC or MCC 6.1.1 is uninstalled from the system:

[HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run]

Solution

A hotfix (SOLIDCOR611-379_WIN.zip) for MAC / MCC 6.1.1 is available from the McAfee Downloads site.

IMPORTANT: Upgrade to the hotfix before uninstalling MAC / MCC 6.1.1. Refer to the MAC / MCC 6.1 Installation Guide (PD24678) for details on upgrading.

McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Workaround

For systems with VSE installed, do the following:
  1. Log on to the ePO console.
  2. Click Menu, Policy, Policy Catalog.
  3. Select VirusScan Enterprise 8.8.0 for the Product drop-down and select Access Protection Policies for the Category drop-down. 
  4. Click the appropriate policy under the Category column.
  5. Click User-defined Rules for Categories and click New.
  6. Select Registry Blocking Rule as Rule type and click OK.
  7. Enter the following:
    • RUN Key Protection for Rule name.
    • Enter the following in Processes to include:

      msiexec.exe, explorer.exe, regedit.exe
       
    • Select HKLM for the Registry entry and enter  /SOFTWARE/Microsoft/Windows/CurrentVersion/Run in the text box.
    • Select Key for the Registry key or value to protect entry.  
    • Select Delete key or value for Registry actions to block.
      NOTE: A complete properties snapshot is also attached for reference.
       
  8. Click OK.
  9. Click Save.
  10. Send an Agent Wakeup call to enforce policy. 
  11. Uninstall MAC / MCC 6.1.1.
 

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.