cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Re: System shutting down after latest DAT update 5958.0000

Jump to solution

Here is the extra.dat to resolve this issue.

Highlighted

Re: System shutting down after latest DAT update 5958.0000

Jump to solution

We are being told to reboot affected computers in safe mode. Apply extra.dat (see attached from McAfee)

An EXTRA.DAT file should be placed in the same directory in which VirusScan is installed and the machine rebooted.

This location is generally C:\Program Files\Common Files\Network Associates\Engine\

You may need to also copy svchost.exe back to affected computer as well.

Message was edited by: April Jacobs to remove attachment. on 4/21/10 4:44:27 PM CDT
Highlighted
Level 7
Report Inappropriate Content
Message 13 of 17

Re: System shutting down after latest DAT update 5958.0000

Jump to solution

Does anyone know if this major probem is affecting all McAfee products, or solely VirusScan Enterprise?

Many thanks,

Highlighted

Re: System shutting down after latest DAT update 5958.0000

Jump to solution

Affected systems are VirusScan Enterprise 8.7 (not lower versions such as 8.0 or 8.5) ... on Workstations only from my understanding.

Highlighted
Level 12
Report Inappropriate Content
Message 15 of 17

Re: System shutting down after latest DAT update 5958.0000

Jump to solution

5959 has been out for a couple of hours, so that should take care of the false positive.

Highlighted
Level 7
Report Inappropriate Content
Message 16 of 17

Re: System shutting down after latest DAT update 5958.0000

Jump to solution

I posted this on another thread, but thought I would add it here as well in case any of you needed it.  Good luck everyone.

For those of you who don't use ePO or have found the svchost file severely damaged and the extra.dat fix not working for you, here is the way we were able to repair our affected machines.  On some of our machines the OS was so messed up most of the services, including some of McAfee's were not running (which prevented us from rolling back the DAT), nor could we revert to the previous DAT because we were unable to install at all.

Basically you break McAfee, repair the OS, remove McAfee and then re-install it.

For this we used CD's so we wouldn't have to deal with getting USB keys to load, especially since drivers were not loading correctly for some of our machines.

1) Get an undamaged copy of svchost.exe.

2) Create a CD with the following on it: McAfee AntiVirus 8.7i (this is the install files) and the undamaged copy of svchost.exe.

3) Boot Windows into Safe Mode.

4) Rename the McAfee folder (C:\Program Files\McAfee) to McAfeeXZ

5) Reboot to Normal Mode.

6) Load the CD you created and open a command prompt (you may need to Ctrl-Alt-Del to load Task Manager, do a File>New Task (Run..) and type cmd).

7) (Assuming your CD drive is D:\) type the following command: copy d:\svchost.exe c:\windows\system32\.

😎 Hit enter and when it asks if you want to overwrite type Y and hit enter again.

9) Reboot.

10) Test the Internet, if it is working, you are in good shape.

11) Go to Add\Remove Programs and remove the McAfee VirusScan Enterprise & McAfee Agent (in that order).

12) Delete the old McAfee folder (C:\Program Files\McAfeeXZ)

13) Reinstall McAfee from your CD and perform the update during the post-installation to get the latest DAT file.

14) Make sure you create any schedules scans you had or configuration changes you made before, as it will be a fresh install of McAfee.

15) Reboot and test it out, everything should be working as it was before, including the OS.

Highlighted
Level 7
Report Inappropriate Content
Message 17 of 17

Re: System shutting down after latest DAT update 5958.0000

Jump to solution

w32/wecorl.a False Positive Recovery

McAfee has published recovery procedures for the following two scenarios:

    *      Recommended Manual Recovery Procedure using the Extra DAT where DAT 5958 is currently installed

    *      Alternate Manual Recovery Procedure using DAT 5959 where DAT 5958 is currently installed

This information has been posted on http://vil.nai.com/vil/5958_false.htm and will be continuously updated as more information and procedures become available.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community