Fighting Remote Control: How to Disable Intel ME. Intel Security Assist what is this program and is it needed? What is it and why you need to disable

McAfee offers comprehensive solutions for antivirus protection and a secure Internet experience. Download antivirus software and protection programs against spyware McAfee to protect ourselves from the latest web threats

List of programs

McAfee Endpoint Security
Enterprise antivirus with all the features you need: Threat Prevention, Firewall, Web Control, and Adaptive Threat Protection

McAfee LiveSafe
Comprehensive antivirus, cross-platform solution to protect all your devices on Windows, Mac OS, Android and iOS platforms. Includes firewall, web protection, password manager, parental control and secure cloud storage

McAfee Total Protection
Comprehensive real-time protection: antivirus, antispyware, antispam, firewall and parental control, as well as automatic cloud backups and encrypted data storage

McAfee AntiVirus Plus
Basic protection against viruses and Internet threats. Antivirus and antispyware, two-way firewall, web protection with SiteAdvisor, permanent data wipe and system cleanup

McAfee Internet Security
Comprehensive anti-virus solution. The most complete and effective protection against viruses and Internet threats, computer optimization and online backup 1 GB

McAfee Security Scan Plus
Free scanner that checks the system for updated antivirus protection, firewall, web protection. The utility also allows you to detect malicious threats in active processes

McAfee Stinger
Free, no installation required utility for detecting and removing known viruses, Internet worms and Trojans from your computer

McAfee Real Protect
Proactive zero-day threat protection that uses real-time behavioral detection technology to monitor suspicious activity on the system

McAfee WebAdvisor
Free Intel Security Plugin for firefox browsers, Google chrome and Internet Explorerproviding protection against malicious, phishing and fraudulent sites and malicious downloads

True Key
Intel Security True Key Password Manager offers support for Windows, Mac, Android, iOS platforms and multiple multi-factor authentication methods to maximize the security of your passwords

McAfee SiteAdvisor Live
Web mcAfee antivirus SiteAdvisor Live provides protection against malicious sites and phishing, safe web searches, link checking in emails and online chats

McAfee Rootkit Remover
Standalone utility designed to detect and remove a set of rootkits and related threats. McAfee Anti-Rootkit can currently detect and remove the ZeroAccess and TDSS rootkit families

McAfee Mobile Security for Android
Free antivirus for Android, anti-spam, anti-theft with remote control via SMS and web portal, secure mobile web surfing and protection of Wi-Fi connections, cloud backup for smartphone or tablet

McAfee Mobile Security for iOS
An application to protect iOS devices from viruses and Internet threats with backup and anti-theft functions

McAfee Mobile Innovations for Android
McAfee Mobile Innovations is a universal application for securing Android devices. Key Features: Smart Perimeter, Secure QR Scanner and Secure Data Storage

McAfee GetSusp
The free McAfee GetSusp utility is designed to search for malicious programs that have not been noticed by anti-virus protection. Discovery is based on a combination of heuristic technology and McAfee's online safe file database

McAfee FreeScan
Convenient and free product for checking your computer for viruses, without installing any software

McAfee FakeAlert Stinger
A special version of Stinger that uses Super Scan mode to detect fake antiviruses and recover the system after their exposure

McAfee Rootkit Detective
Free utility for detecting and removing hidden malicious modules (rootkits) running on the system

McAfee On-Demand VirusScan
Antivirus scanner on demand. Free version antivirus McAfee VirusScan, which allows you to scan and cure your computer from viruses, Internet worms, Trojans and other malicious programs

McAfee Virus Database Updates
Virus base files V2 DAT and V3 DAT, designed to update products installed on servers and workstations that are not connected to the Internet.

McAfee is one of the leaders in cybersecurity, offering advanced security solutions to end users, small and large businesses, corporations and government agencies. McAfee security technologies leverage the unique predictive capability of McAfee Global Threat Intelligence to keep home users and businesses one step ahead of the next wave of viruses, malware and other Internet threats.

McAfee offers comprehensive, integrated solutions to ensure information securityprotecting all environments. McAfee endpoint security solutions and mobile devices ensure the safety of end-user devices from threats such as viruses, phishing, malware, and includes antivirus software and web protection functions. Firewall solutions keep your network and its perimeter safe. McAfee solutions protect servers, databases and data centers from threats that target corporate systems.

McAfee cloud security solutions provide advanced protection against Internet threats, whether your cloud computing technology is private, public, or hybrid. All security solutions are centrally managed from a single McAfee ePolicy Orchestrator console to efficiently and quickly manage your security infrastructure.

McAfee software:

• Compliance with confidentiality requirements and maximum protection of critical data: McAfee Endpoint Encryption, McAfee Total Protection for Data and McAfee Total Protection for Data Loss Prevention.
• Maximum protection of databases of external and internal threats in order to reduce the level of the possibility of information loss: McAfee Database User Identifier, McAfee Database Activity Monitoring, McAfee Virtual Patching for Databases and McAfee Integrity Monitoring for Databases.
• Providing protection when working with by email and on the internet: McAfee SaaS Web & Email Security withArchiving, McAfee Content Security Suite, McAfee Security for Email and McAfee Email Protection.
• Endpoint Protection: McAfee Endpoint Protection and McAfee Total Protection for Endpoint.
• Network protection: McAfee Network Security Platform, McAfee Network Security Manager and McAfee Network Threat Response.
• Compliance and Risk Protection: McAfee Configuration Control, McAfee Application Control, McAfee Risk Advisor and McAfee Policy Auditor.
• Cloud protection: McAfee SaaS Endpoint Protection, McAfee SaaS Email Encryption and McAfee SaaS Web Protection.
• Management and control over the protection of enterprise information: McAfee ePolicy Orchestrator.

McAfee Antivirus is considered the most current and balanced antivirus out there. Availability, low resource consumption, elementality - all this is about McAfee antivirus, which you can buy in our online store. A license is required for the correct use of this antivirus.

Probably none of the users of computer or mobile systems it is not necessary to say that today, on the same Internet, to access many services, services or sites, you need to enter a username and password. But you can't remember all of them. And keep the data on the computer as the same text file, and even in unencrypted form, is a very dangerous business. One solution to this problem is Intel Security True Key. It was developed jointly by Intel and MacAfee Corporation. So why are many users who have tried it in practice trying to get rid of this application?

True Key: what is this program?

The True Key application is positioned as a reliable utility that allows you to store logins, passwords and any other user registration data not on a personal computer or laptop, but on a remote server.

In addition, there is another side of the True Key app worth paying attention to. What kind of program is this in terms of security of access to confidential data, it is not difficult to understand if you look at the capabilities of its system for the safety of confidential information. Naturally, there is full encryption of information, the ability to synchronize between multiple accounts, setting a trusted device to log in, etc.

What is True Key for: security issues

In terms of protecting data from unauthorized use, the application offers more than standard methods. So, for example, in addition to encrypting and installing secure communication channels, the program allows you to identify a user by a fingerprint or even by matching facial features.

Thus, protection seems to be provided at the highest level. However, the storage of registration data does not take place on the local terminal, but, as already mentioned, on a remote server, which increases the user's chances that his information will not be stolen.

However, not all so simple. Now for another look at the True Key app. What kind of program this is, it is already a little clear, let's move on, so to speak, to the commercial side. The fact is that the application itself is, as it were, shareware. Why "how"? Just because the free version supports serving no more than 15 passwords. If there are more of them, you will have to fork out for a premium account, which will cost about $ 20.

Why does it need to be removed?

Now the most important question is: "Why are some users trying to get rid of such a seemingly necessary and advanced application?" (How to remove the True Key program using several methods will be discussed a little later).

Here, according to many users and experts, the problem is that the application developers have clearly gone too far with advertising, and some authorization methods look very inconvenient. In addition, the program spontaneously gets on some computers. This happens either if the Intel driver update utilities are available on the computer, or by installing other applications as affiliate program, or in the form of a virus masquerading as an official utility. In the latter case, the user gets a browser hijacker that makes it difficult to find, changes the start pages, adds ads, redirects him to commercial or questionable sites, and steals personal information. And this option has nothing to do with the official app.

Standard procedure

So, let's see how to uninstall the True Key program using the simplest method, using OS tools for this. Let's make a reservation right away: the application is cross-platform, and the technique may differ on different systems, so we will give you the removal methods for Windows.

Let's say the user is faced with a number of questions: "What is this - True Key?" and "How do I uninstall the program?" Let's assume that he has already figured out the first one. We must find the answer to the second.

The solution to the problem is standard for all Windows systems. To uninstall an application, use the section of programs and components in the "Control Panel", where you just need to find the program itself and perform a standard uninstall. But that's not all.

After that, you need to enter the registry editor (regedit in the Run console), search by name and delete all the keys corresponding to the application. But this way you can delete and not at all what is required.

Therefore, after standard removal, it is better to use the CCleaner utility or something similar, which will find all obsolete or unused keys and remove them without user intervention.

Using highly targeted utilities

Another solution would be to use programs like iObit Uninstaller... Its interface is somewhat reminiscent of the window of the Windows programs and components section, so it will not be difficult to find a program in the list.

In this case, the standard uninstaller will first be launched, after which it will search for residual files and registry keys. All this garbage will also need to be removed, and with the use of the line for destroying files on the hard disk. If for some reason the application does not appear in the list, it can be uninstalled using the Forced Uninstall module with a preliminary search.

What if it's a virus?

Finally, a few more words about the True Key app. What this program is in the original is already clear. But if, after installation, there are assumptions about a virus with the above symptoms, you should first use, but not the one installed in the system, but some third-party portable utility, and if the threat is not detected, apply the listed actions for manual removal.

Note: in all cases, first, in the "Task Manager" you need to forcibly terminate all processes associated with the program, remove the application module from startup, and it is advisable to delete it with the system booting into safe mode (mandatory only for cases of detection of viral infection).

Fighting Remote Control: How to Disable Intel ME

Alexander Antipov

Intel ME (or AMT, Active Management Technology) is one of the most mysterious and powerful elements of modern x86 platforms. The tool was originally designed as a remote administration solution. However, it has such powerful functionality and is so out of the control of users of Intel-based devices that many of them would like to disable this technology, which is not so easy to do.

At the Positive Hack Days VI forum held on May 17 and 18 in Moscow, Positive Technologies researchers Maxim Goryachy and Mark Ermolov presented several techniques for disabling Intel ME, accompanying the report with a video demonstration of the process.

What is it and why you need to disable

The Intel Management Engine (ME) is an additional "hidden" processor that is present in all devices based on Intel chipsets (not only in PCs and laptops, but also in servers). The ME runtime never "sleeps" and works even when the computer is off (if there is a standby voltage), and also has access to random access memory, network interface, USB controller and integrated graphics adapter.

Despite such extensive capabilities, there are questions about the security level of ME - earlier researchers have already found serious vulnerabilities and attack vectors. In addition, the subsystem contains potentially dangerous functions - remote control, NFC, hidden service partition. The ME interfaces are undocumented and the implementation is proprietary.

All these reasons lead to the fact that many consider ME technology as a "hardware". The situation is aggravated by the fact that, on the one hand, the device user does not have the ability to disable this functionality, and on the other hand, the equipment manufacturer can make mistakes in the ME configuration.

The good news is that there are still ways to disable ME.

Intel ME shutdown techniques

Researchers from Positive Technologies Maxim Goryachy and Mark Ermolov presented a report on the Intel ME shutdown during the Positive Hack Days VI forum held in Moscow. Experts have described several techniques for disabling this subsystem:

1. ME initialization failure based;
2. Through the ME firmware update mechanism;
3. Undocumented commands
4. An undocumented mechanism intended for hardware designers is Manufacture Mode.

Researchers have found that developers of hardware platforms often forget to turn off Manufacture Mode, which allows the latter method to be used on a large number of computers at no additional cost in "real time".

Most of the shutdown methods use built-in ME mechanisms designed for Intel platform device vendors. All of them are described in detail in the presentation, which is published on GitHub. The link provides a demo video of disabling ME (it's also below):

Nevertheless, a reasonable question arises: "Does the ME really stop working in full when using its built-in shutdown mechanisms?" As evidence of the fact that ME is disabled, the researchers cite the following argument: ME operates in two modes of memory use: only SRAM (built into ME) and SRAM + UMA. UMA is a portion of host memory that is used as swap memory. After the host initializes the DRAM controller, the ME always switches to SRAM + UMA mode.

Thus, if ME is really turned off, then when ME access to UMA memory is disabled at the hardware level at an arbitrary moment (via the VCm channel), there will be no hardware failures in ME due to the lack of data and code that were pushed into UMA memory. (such hardware failures will lead to an emergency power off from the main hardware components of the platform). On the other hand, the use of these methods allows for DoS attacks on AMT technology if it is used for remote control.