So if you are like me, you know how to browse the web better than the computer can tell you. Products like McAfee SiteAdvisor and Norton Safe Web are not tools to rely upon, even if you're a novice web user. Reputation is the key to browsing the web safely. If you've never heard of a website before, don't go there. Seek out advice from others on what sites are safe. Sure, these software products will help reduce your human errors, but if you're in the expert zone, they become a complete waste of CPU cycles. And if you're working in corporate business, you'd be lucky if SiteAdvisor or Safe Web wasn't disabled by policy anyway.
But corporate policy doesn't eliminate SiteAdvisor. Instead, it leaves a distasteful gray menu button at the top of your screen. In the era of maximized screen real estate, putting a button on top of everything is a HUGE no-no. It turns your product from a reliable tool into invasive nagware. It's not malicious, but it becomes so nefariously annoying (I'm talking Dr. Evil-level annoying) that the entire suite of McAfee products should be rightly thrown out and replaced by anything but.
In my continual quest to delete the SiteAdvisor from my computer, I have found very dumb cop-out answers like "Go to 'Programs and Features' and uninstall it". You can't do that when there is policy enforcement going on.
The latest conflict in my holy war against McAfee has been SiteAdvisor Enterprise 3.5.0. I arrived at work, turned on my computer and discovered that SiteAdvisor mucked up my proxy settings and forced itself upon Firefox. I don't care one bit about Internet Exploder, but when SiteAdvisor attempts to step on the holy ground of my Firefox experience, it immediately elevates to all-out battle.
The "wonderful" gray menu button of SiteAdvisor was covering up the "New Tab" button and the right-most tab to a point that I couldn't read the title of the tab or close the tab without shifting its position, which left another tab masked by the stupid button.
After restoring my proxy settings, I went to work attempting to defeat this Firefox extension. To no surprise, SiteAdvisor hides itself from the extension list now. They have learned the joy/pain of using distribution bundles--Plugins you can't delete or disable from within Firefox.
In addition to cramming its ugly paws in the distribution bundle folder, McAfee enacts policies to ensure you can't delete files owned by McAfee.
The Battle Plan
So here's what I did to cripple this trojan horse of a security tool. First, I discovered where SiteAdvisor is hiding itself these days, and here it is:
C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\{B7082FAA-CNow, if the fact that SiteAdvisor is hiding itself wasn't enough, hiding behind a UUID is even more dishonest. They'll argue that they're hiding from malware makers, but that's a complete joke. A dumb reason.B62-4872-9106-E42DD88EDE45}
I found out that McAfee was blocking these files from deletion after I took my Administrative liberty to kill McAfee processes. Before you can kill SiteAdvisor, you need to kill McAfee itself. Terminate in this order:
- mcshield.exe
- McSACore.exe
BUT WAIT! Deleting the extension from Firefox isn't enough. The next time SiteAdvisor starts up again, it will seek out Firefox and dig its dirty paws right back into the same place. So you have to take this battle two steps further. You have to delete these files at their source. When you have those processes down for the count, delete these files:
- Everything but 'sae.lock' in C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\Components
- The entire folder of C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\scripts
- The file, C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\chrome.manifest
- The file, C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\install.rdf
- Any DLLs with the letters "ff" in them under, C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise
Open up "regedit.exe" from the "Run..." menu.
Seek out and change this key:
Old:This sets the services from "Automatic" to "Disabled". A value of 3 would be "Manual" or on-demand.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Enterprise Service]
"Start"=dword:00000002
New:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Enterprise Service]
"Start"=dword:00000004
At minimum, this should eliminate SiteAdvisor from interrupting your Firefox browsing experience. At best, it will keep it from even taking up CPU cycles.
To give it all a test, reboot your computer or at least re-start the "McAfee McShield" windows service. You can find this by running "services.msc" and scrolling through the list. You should also see that "McAfee SiteAdvisor Enterprise Service" is listed as "Disabled".
Now, start up Firefox and go to the url "about:plugins". This will tell you what plugins are running. Make sure SiteAdvisor isn't listed. If it is, seek out the DLL file and destroy it like the rest (Don't forget to terminate mcshield.exe before deleting these files).
If I missed a step, or you have additional suggestions, let me know in the comments and I will update this solution.