Same here. Ironically if you disable on access scan on boot, and then boot up and scan svchost.exe, it scans clean.
do a shutdown /a on the affected client to stop the shutdown process, and then go to the virusscan console, tools, rollback dats.
Is there a way to rollback DATs on EPO 4.5?
delete the new dat out of the repository, move the previous dat to current branch and then (if its not already selected) in the mcafee agent policy- updates- select the box "
remember to update distributed repos too.
agent wakeup calls etc to push policy???
We have successfully overcome this error and included the changes in the DATs that followed. Please see KB68787 for answers to frequently asked questions about the McAfee DAT 5958 False Positive Error.
Also, kindly go through the information available at:
Thanks and Regards,
McAfee is aware of a w32/wecorl.a false positive with the 5958 DAT file dated April 21 at 2:00pm (GMT +1).
Information updates will be given every 90 minutes to keep you advised.