Kill Real Time Antivirus in VBS

[tqeonline]

Hello All,

I have a vbs script that goes and does a bunch of copying of files and backing up of files. REcently the server I had this running on got a corporate anti-virus setup. I have found that if i kill "RtaAgent.exe *32" in the Processes then kick of the vbs it runs great.

However if I don't kill it, it sees it as a virus and stops it.

The RtaAgent will be killed for about 1 minute which gives me time to kick off the script before it automatically opens and starts running again.

Question: how could I make my current VBS script kill that process on execution?


- Matt

"If I must boast, I will boast of the things that show my weakness"

- Windows 2003 Server, 98 SE, XP
- VB.NET, VSTS 2010, ASP.NET, EXCEL VBA, ACCESS, SQL 2008

 

[strongm]

Presumably the company has no issues with the AV product being shut down

 

[tqeonline]

no it's a system policy of having the real time antivirus run. Disabling it and reenabling it to run a process on a dev box is acceptable practice.

- Matt

"If I must boast, I will boast of the things that show my weakness"

- Windows 2003 Server, 98 SE, XP
- VB.NET, VSTS 2010, ASP.NET, EXCEL VBA, ACCESS, SQL 2008

 

[tqeonline]

Dim objWMIService : Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
Dim colProcesses : Set colProcesses = objWMIService.ExecQuery("SELECT * FROM Win32_Process")
Dim objProcess
For Each objProcess In colProcesses    
	if (objProcess.name = "RtaAgent.exe") then
		Set objShell = CreateObject("WScript.Shell")
		strCmd="TaskKill /f /im " & objProcess.name 
		objShell.Run strCmd,0,True
	end if
Next

Complete. Just back up this with more data. This just shuts it off temporarily so file copying/backup isn't seen as a virus. There is another Process that monitors RTAAgent.exe to exist and if it doesn't then it kicks it off again. This gives me enough time to initiate my program.

- Matt

"If I must boast, I will boast of the things that show my weakness"

- Windows 2003 Server, 98 SE, XP
- VB.NET, VSTS 2010, ASP.NET, EXCEL VBA, ACCESS, SQL 2008

 

[guitarzan]

If you can add an exception to the AV's real-time scanner, that would really be a more robust solution than killing the process and hoping your script sneaks in it's work before the AV recovers it's senses.