The office where I'm currently working uses McAfee security products. Someone, somewhere in the organisation seems to believe that these will protect us from evil. Anyway, one of these products is McAfee VirusScan - and it's driving me nuts. It has a painfully annoying feature called On-Access Scan that basically scans every single file you access just in case it's a virus. Every single file! Needless to say, throughout the course of a day this can be a lot of files. Now it wouldn't be so bad if it was quick about it, but it takes forever! And sadly, due to the way it's been installed, there's no in between - it either scans every file, or none at all.
As you can imagine, this gets pretty annoying real fast. Something as simple as compiling some code ends up taking 5 times as long while McAfee checks your code for viruses. It's like one of those friends that everyone had at high school who was always hanging around even though nobody liked him. No matter where you went, he always seemed to show up.
Fortunately I'm lucky enough to have administrator privileges on my PC so I was able to get rid of the annoying friend whenever I pleased. Occasionally he'd show up again after a reboot, but I could always get rid of him with a few swift kicks, I mean clicks.
Now you might think that turning off the virus scanner isn't the smartest move, but our internet access is so restricted in the office (thanks to our big brother proxy) that there's simply no chance of me finding a site that might have something sinister to offer. As for contracting a virus via email - well we use Lotus Notes and I don't think hackers can be bothered writing viruses for Notes!
Anyway, back to the annoying friend. So things were under control, I could get rid of the virus scanner any time I liked. But yesterday things changed....
When I arrived at work yesterday, my friend was back, snooping around my files. Weird. I hadn't rebooted recently, so why was he back? I didn't give it much thought at the time, I just disabled the scanner and got on with my day. But 20 minutes later he was back again. Hmmm.
I discovered that over night the system administrators had installed another annoying McAfee product - ePolicy Orchestrator. This tool lets you create a security policy that can be enforced over the network. Every 30 minutes, my PC was checking back with the policy server to make sure it was running everything it should be. Unfortunately, it noticed the virus scanner wasn't running and started it up again.
Bugger. The my friend was back and this time he wouldn't go away. Time for a new plan.
I could have tried un-installing the virus scanner, or the even whole suite of McAfee products. But I figured that probably wouldn't go down too well with the IT guys. So instead I wrote this little Ruby script that launches when I log in.
trap('INT') { exit }
while (true) do
system 'net stop mcshield > NUL 2>&1'
sleep 60
end
For now that seems to keep him away. I wonder what the sys admins will try next :)