If You use McAfee AV and your PC has gone loopy...

[clt_capt]

This morning McAfee released the 5958 virus definition files (DATs) which are improperly identifying systems as infected with the W32/wecorl.a worms virus. This is causing an incorrect false positive identification of the server service (C:\Windows\System32\svchost.exe) on Windows XP, which results in a system shutdown and possible system blue screen. Clients that have already downloaded the DATs will need assistance to rollback their antivirus protection to circumvent this issue.

As a temporary workaround until McAfee releases the updated 5959 DATs today, please follow the below steps:

1. Boot the affected client into Windows Safe Mode with Networking.
2. Disable the McAfee McShield service by opening the Registry Editor (regedit.exe), and set the McAfee McShield service to the Disabled startup type: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\McShield\Start=4.
3. Reboot into normal Windows mode.
4. Right-click on the VirusScan shield icon, select VirusScan Console….
5. In the VirusScan Console, select Tools | Rollback DATs to rollback to the 5957 DAT files.
6. Open the Registry Editor (regedit.exe), and set the McAfee McShield service to the Automatic startup type: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\McShield\Start=2.
7. Open Control Panel | Services and start the McAfee McShield service.

[Robja]

HUH????????

Fred,

Do you have a redneck laymans terms you can put that in. I have windows 7 on my net book would it be affected the same way if I use McAffee? Would it be better to not update McAffee until it is fixed? I am clueless.

[Robja]

HUH????????

Fred,

Do you have a redneck laymans terms you can put that in. I have windows 7 on my net book would it be affected the same way if I use McAffee? Would it be better to not update McAffee until it is fixed? I am clueless.

[clt_capt]

Ok - One more time slowly... If you run Windows XP and McAfee is your anitvirus, You do not want to download - either manually or automagically - today's Virus update (DAT5958) - it is broke.

Wait until the new version (5959) comes out to update your AV Definitions...


Windows 7 does not appear to be affected...yet