Had an issue today where some automation code (basically VB that instantiates Word, Excel, or PowerPoint objects), started failing inexplicably.
The only thing the user could think of is that he’d just installed the lastest McAfee AntiVirus.
So, I tried a little test, opened Excel, opened the VB editor in it, then entered:
Sub Main
Dim X as object
Set x = CreateObject("Word.Application")
End sub
And that failed too!
After a few googles, I came up with this.
Appearently, McAfee includes a feature called HAWK (Hostle Activity Watch Kernel), that monitors things like CreateObject.
And the fun part is that even if you disable McAfee, HAWK still runs in the background. You have to turn it off seperately in the McAfee UI.
Yet another reason to use NOD32.
8 Comments
Howdy Darin! Thanks for posting this. I use office automation a lot in my vb projects, and many of my customers are cursed with McAfee. I just KNOW I’ll be getting calls about this very issue soon, and now I know what to check.
BTW, I’ve been lurking here for a bit and have been amused / pleased / impressed with the width and depth of things you write about. Please keep it up.
Thanks,
Ralf
Hi Ralf
Thanks for the comments, glad to know my experiences might help out!
I’m also happy to report you are my first official comment since I started up this blog! So, definitely, again, a big thanks!
Darin
Howdy again,
I’m a longtime NOD32 user myself (heh) and thus do not have any McAfee products to test against. Are you aware of how to programatically check for the existence of HAWK and alert the user? Registry keys or an in-memory task to look for or…?
I guess I *could* just try to substantiate a Word.Application object and pop up a warning if that fails. But there are other things that can cause that, such as Office not being installed. It’d be nice to tell the difference.
Any ideas?
Thanks,
Ralf
I don’t have McAfee myself, either, so I’m not sure how to test specifically for it.
I’m guessing one approach would be to detect if Word is installed (that’s easy, just check for the existance of "HKEY_CLASSES_ROOT\Word.Application", if that key’s there, Word is bound to be installed), and if it’s there, try to instantiate it.
In my particular case, I know Word is there because it had to be there when the user installed my app or it wouldn’t have installed. Granted, they +could+ have uninstalled it later, but I handle that with standard error handling techniques.
Back to HAWK, though. I’m betting there is a way to detect it, either through a reg entry or an installed file in WINDOWS or SYSTEM32, I just have no idea what it would be.
Wish I could help more.