McAfee Update is Shutting Down Windows XP PCs

[edilee]

Isn't this the second time within a couple months this has happened with Mcafee? That is just pure stupidity for an AV to detect OS files as viruses especially one of the main files.

 

[aford10]

Lots of arm-chair quarterbacks here.

We use McAfee under an enterprise license agreement, and have a few thousand computers covered. Haven't had any significant problem in over 15 years and receive good customer support.

This issue has only plagued our XP boxes, the Win7 and WinVista boxes are running fine. Our IT Dept figured out the problem a little before lunchtime and the fixes are being rolled out now. This seems like a QA problem with the DAT file, since it's pretty consistent with every XP box. Someone dropped the ball and is probably gonna get fired!

That's because it is specific to XP.

You should read the article instead of criticizing the responses of others.

 

[hunter315]

Unfortunately almost all of the computer labs on campus are running XP so it hit about a thousand machines here, plus a few hundred personal machines. Since its only affecting XP maybe ITS will upgrade us to 7 to fix the remaining issues, would be nice to finally move on in the world.

Gotta love it when good anti-viruses go bad, they can cripple you worse than a virus ever could.

 

[Guest]

Was hit by this earlier today (as were hundreds, if not thousands, at my company), before all of the good info came out about what was going on and how to fix it. Spent about 3 hours figuring out what went wrong and how to fix it. Once back up, saw all the info about what happened and how to avoid and fix. Too late for me, but hopefully others will benefit from this info:

As a temporary workaround until McAfee releases the updated 5959 DATs today, please follow the below steps:

1. Boot the affected client into Windows Safe Mode with Networking.
2. Disable the McAfee McShield service by opening the Registry Editor (regedit.exe), and set the McAfee McShield service to the Disabled startup type: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\McShield\Start=4.
3. Reboot into normal Windows mode.
4. Right-click on the VirusScan shield icon, select VirusScan Console….
5. In the VirusScan Console, select Tools | Rollback DATs to rollback to the 5957 DAT files.
6. Open the Registry Editor (regedit.exe), and set the McAfee McShield service to the Automatic startup type: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\McShield\Start=2.
7. Open Control Panel | Services and start the McAfee McShield service.

The new 5959 dat file update HAS been released, and can be downloaded from McAfee here:
http://www.mcafee.com/apps/downloads/security_updates/superdat.asp?region=us&segment=enterprise

I'm sure that SOMEBODY at McAfee got escorted to the parking lot today...

 

[nforce4max]

I HATE McAffe their so called anti-virus is crap and causes more problems than it solves like making printers and scanners not work as well many other issues. Their $5 a month fee from a subsidiary is fraud and they are already being sued.

 

[Guest]

In addition to my previous post (which was more geared on how to avoid the issue), here is more info about what to do if you actually are currently impacted, and constantly rebooting.

1. Upon boot-up, press F8 immediately after the BIOS initializes, and select Windows Safe Mode with Networking by using the arrow keys.
2. If prompted, choose the Windows XP Professional menu option.
3. When the login screen appears, log in as appropriate. There might be a longer than usual delay for the login to complete.
4. In the VirusScan Console, double-click on the Quarantine Manager Policy.
5. In the Quarantine Manager Policy window, select the Manager tab.
6. If there is any instance of W32/Wecorl.a virus listed, select one and right click to select Restore. This should restore the file (C:\Windows\System32\svchost.exe) back to its original location. It might prompt you to confirm your selection.
7. Repeat steps 1-3 to re-enter Windows Safe Mode with Networking
8. Download and run the fixed 5959 dat update here: http://www.mcafee.com/apps/downloads/security_updates/superdat.asp?region=us&segment=enterprise

If at any point you get a notice that there was an error and your PC will reboot in xx seconds, you can stop that by going to Start, Run and enter "shutdown -a" (without the quotes) to abort the shutdown, so you can continue working on restoring the svchost.exe file.

Good luck.

(P.S. - I Don't work for McAfee, and am glad because I expect their stock to take a hit for this outrage.)

 

[UmeNNis]

AdAware Professional suite ftw

 

[Guest]

Please people, the reason why we need this is because Microsoft delivers beta products with 150,000 known bugs! I will forgive McAfee an error they can correct on the basis that they have "BandAided" my hunk of junk PC for years! (Also I wasn't effected.) Mac is my next buy Mr Gates.

 

[micky_lund]

ahhh...freeware is the way to go
avira antivir

 

[dstln]

Most AV is terrible, bloated and unnecessary, especially any of the pay "suite" varieties.

I had a similar issue years ago with Norton. It didn't brick my comp but it did keep finding its own auto-update system as a trojan every few minutes. And that was the end of that, amazing how dumb these programs are sometimes.

 

[JOSHSKORN]

I NEVER have had ANY luck with McAfee. MSE...FTW!!!

 

[pythy]

People actually use McAfee??

 

[DawnTreader]

McAffee is the biggest piece of software dung i have ever had the displeasure of working with. i wonder how they still exist being such craptastic junk. it totally boggles my mind why anyone would want to use it. the first time i ever used it, a trial version, it slowed my computer to a crawl, this was back in win98se days. then when i got a virus it actually attacked McAfee and made it impossible to uninstall the stupid antivirus software. i ended up with a complete windows reinstall in order to undo the damage. i also worked at a computer shop for a while and everytime McAfee was on the customers computer it came in with viruses. the only thing i use now is NOD.

 

[Guest]

This happened to the entire campus network today here at my school (UMBC). Nobody could log in to any of the desktops for most of the day.

 

[ravewulf]

Deleting svchost.exe? How can they screw up that badly?

 

[Vorador2]

I use Kaspersky at work. It's a resource hog, but it does the job.

At home i use a paid license of Avira. It's pretty good overall, so i think i will renew the license in the future.

 

[gncs91]

[citation][nom]norb8[/nom]Your obviously a Mac user since any self respecting Linux user admits that Windows is the primary target for spyware and viruses because of its large user base. Since your a Mac user, why don't you go to Starbucks and work on your novel or some hippy crap. Leave Toms Hardware to the big boys who can actually change their computer hardware and do something useful with it.[/citation]

ok, thats probably the best diss ive ever read... nice one! lmao

 

[Guest]

I've spend all the morning (I live in Spain) reparing computers because of this update.

 

[Regulas]

Easy fix, run Linux or even OS X.

 

[nukemaster]

I guess testing updates has gone out the window.

 

[cykro]

My computer was so weird this morning when I got to work I thought I had got a "virus".
And then I heard I had in fact got an "antivirus"...
Well, it's McAfee, same shit...

By the time my computer was restored, it was time for lunch.
I soooo hate McAfee...

 

[randomizer]

In case you people didn't realise, Linux dominates the web server market. So saying it has a tiny market share is a fallacy. Virii get written for web servers too, and these often use the web server to spread to client computers. Now OSX on the other hand does have a small market share. The only site that I know of which runs on a Mac is XtremeSystems (yea, really).

 

[2zao]

too many free anti-virus to be paying for it anyway

Avira personally
Avast if not that

McAfee is second to last only to Norton Symantec

 

[Guest]

Epic fail.

Avast all the way.

 

[Guest]

I am at this moment reinstalling a PC for my landlord (I would never use McAfee my self)that had this problem, i did a repair that solved the problem with the missing svchost.exe file, but the media i used was only SP2, so i begun upgrading to SP3 and sure enough i noticed that McAfee wanted to remove the svchost.exe file again, the only reason i noticed it was when it came with a quick pop-up saying that the svchost.exe file was infected from downloading SP3 from Microsofts website using windows update, removing McAfee before rebooting prevented it from happening again.
When following the virus link in the McAfee log file turned up a empty page on the McAfee website.
All in a days work for, computer repair man...