2 Replies Latest reply on Apr 21, 2010 3:52 PM by manning

    How I fixed out 5958 issue

      Running a network where ePO pushed a bad 5958 dat.

       

      Booted into safe mode on client machine - went to c:\program files\common files\mcafee\engine - copied files from oldengine subfolder into here...

       

      Now went to c:\windows - my svchost.exe file was 0bytes -copied in a svchost.exe from one of my ntuninstall subfolders (dir svchost.exe /s)

       

      Went to epo, deleted 5958 from repository, moved 5957 into current

       

      Rebooted, machine came up with start button/etc...

        • 1. Re: How I fixed out 5958 issue

          Worked for me.... svchost.exe was actually in c:\windows\system32 though...

          • 2. Re: How I fixed out 5958 issue
            manning

            3 out of 30 of my systems were impacted. I fortunately removed the bad DAT from the repository before it was pushed to more clients.

             

            I repaired 2 of the 3 clients by disabling all McAfee services and then restoring svchost.exe from the Quarantine. Then I unistalled McAfee and restarted and everything worked. I then had to force uninstall the agent, then reinstall McAfee and push the agent back to the systems. All works correctly now on those 2 systems.

             

            The 3rd client I can't restore the svchost.exe file though. Even though I can see the instances of quarantined files in the C:\quarantine folder, I can't see them in the console. the file IS still in the default location, but has a size of 0, so obviously McAfee 'cleaned' it or something. And no way to copy it from another computer because I can't seem to  move anything from a USB drive onto the computer.