This is the mail archive of the cygwin@cygwin.com mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: (Partially) OT: Circumventing NAVCE (was: Performance Issuesdue to Anti-Virus software.)


On Mon, 23 Sep 2002, Dan Vasaru wrote:

> dan > Seriously, aren't your developers local administrators ? In that case,
> dan > they could easily disable the AV.
> Igor >I'm of half a mind to set up an ssh server just to be able to su to
> Igor >local system and kill it.  But for now I live with it.
>
> Igor,
>
> Try installing the PSTOOLS package from
> http://www.sysinternals.com/ntw2k/freeware/pstools.shtml.
>
> PSKILL (part of pstools) will kill virtually any process, including
> LocalSystem processes, given enough (local administrator) rights. Of course
> you can also try stopping the service in the ControlPanel (Administrative
> Tools|Services, right click on NAV). Here's where you would restart it.
>
> Dan

On Mon, 23 Sep 2002, Max Bowsher wrote:

> Igor Pechtchanski wrote:
> > Dan,
> > "Good luck" is the exact term needed here, in reference to turning off NAV
> > Corp. Edition.  The service runs as LocalSystem, so anyone with less
> > privilege than that is not able to either turn it off or change anything
> > that is not unlocked.  The way it's set up on my computer, the option to
> > stop the scan is disabled, and the scheduler is locked.  Since the process
> > runs as LocalSystem as well, it is unkillable through the Task Manager.
> > I'm of half a mind to set up an ssh server just to be able to su to local
> > system and kill it.  But for now I live with it.
> > Igor
>
> The pasted REGEDIT file shows how to regain control control of NAVCE. Of
> course, you will need local admin to edit the relevant registry
> locations. I can't say for certain that your version of NAVCE will use
> _exactly_ the same registry keys, but with this as a hint, it shouldn't
> take more than 5 minutes for anyone comfortable with registry editing to
> unlock NAVCE.
>
> Max.
>
> [Registry settings snipped]

Merci beaucoup to all for your suggestions.  This has been plaguing me for
a while.  I was aware of being able to stop the service, but the pskill
and especially the registry settings proved very useful.
	Igor
-- 
				http://cs.nyu.edu/~pechtcha/
      |\      _,,,---,,_		pechtcha@cs.nyu.edu
ZZZzz /,`.-'`'    -.  ;-;;,_		igor@watson.ibm.com
     |,4-  ) )-,_. ,\ (  `'-'		Igor Pechtchanski
    '---''(_/--'  `-'\_) fL	a.k.a JaguaR-R-R-r-r-r-.-.-.  Meow!

"Water molecules expand as they grow warmer" (C) Popular Science, Oct'02, p.51




--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]