Temporarily disable AV

Usage and Config Security
1

(imported topic written by FrederikBraad)

Hi,

I’ve gotten a request from a customer using TEM Core AV, who wants an easy way to temporarily disable AV on a machine, for troubleshooting or specific installation issues. - Either locally via a script or something, and/or as a fixlet.

You would you go about creating such a fixlet? - Would you disable scheduled and real-time scan, temporarily exclude all folders, or is there a better way of doing it? -And could you somehow make a time-limited fixlet, that automatically reverts after perhaps 24 hours?

Thanks!

Frederik

2

(imported comment written by Xie_Ran91)

Most likely, this could be a fixlet or a wizard which helps you configure the policy. I will file a RFE for this.

3

(imported comment written by FrederikBraad)

Good idea. I will definitely do that. Thanks.

Until then, I think we need a temporary solution. -So any ideas would be appreciated. :slight_smile:

4

(imported comment written by Xie_Ran91)

Here I attached a custom fixlet which restarts the two CPM services. You can check the action and read the comments, then copy out the parts which disable the scan services.

Note: the self-protection needs to be turned off in order to turn off the scan services. This is also in the fixlet action attached here.

5

(imported comment written by FrederikBraad)

Perfect! Thank you!

I will try to build something based in this.

FYI: I have also posted an RFE on the feature:
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=43873