ebenzunlimited
Moderator
Most of the worldwide computers that are using the McAfee antivirus and running on Windows XP have been hit with the PC auto shutdown issue. It is reported that, thousands, possibly millions, of computers around the world have been affected with the new McAfee update. There has been issue with a McAfee DAT file 5958- released on Wednesday, April 21, 2010. Its causing stability issues on Windows XP client systems. The symptom is caused by a false-positive detection of the W32/wecorl.a virus on a core Windows file (svchost.exe). Once the file is quarantined by McAfee or in other word it deleted the core windows operating file.
The system may encounter one of the following symptoms:
? The computer shuts down when a DCOM error or a RPC error occurs
? The computer continues to run without network connectivity.
? The computer triggers a Bugcheck (Blue Screen).
Solution 1 (from Microsoft, Difficulty Level: Easy)
To manually repair a computer encounters this problem, follow these steps:
Step 1: Restart the computer in safe mode by pressing F8 before the Windows splash screen appears.
Step 2: Log on to the computer. Then, press CTRL+ALT+DEL, and then click Start Windows Task Manager.
Step 3: Select New Task (Run?) from the File menu.
Step 4: Type cmd.exe, and then press ENTER.
Step 5: Run the following command:
ren ?%programfiles%Common FilesMcAfeeEngineavvscan.dat? avvscan.old
*Notes: This behavior removes McAfee virus definitions. Make sure that you update to the latest definitions (5959 DAT or newer) after you complete these steps to restore virus definitions.
Step 6: Run the following command:
copy %systemroot%system32dllcachesvchost.exe %systemroot%system32
and press ENTER
Step 7: Restart the computer.
Solution 2 (from McAfee, Difficulty Level: Need Some Effort)
Step 1: Goto Start menu , Run, then type cmd and hit Enter to goto the Command Prompt.
Step 2: Type shutdown -a, to prevent the shutdown.
Step 3: Click Start, Programs, McAfee, and then VirusScan Console.
Step 4: Right-click ?Access Protection?
Step 5: Select ?Disable ? If you have Internet access, download the EXTRA.ZIP file provided by McAfee and unzip the EXTRA.DAT within.
*Notes: that Nai.com is a safe site maintained by McAfee, for those who were wondering.
Step 6: Extract the EXTRA.DAT.
Step 7: Click Start, Run, then type services.msc and click ?OK?.
Step 8: Right-click the McAfee McShield service and select ?Stop?.
Step 9: Copy EXTRA.DAT to ?c
rogram FilesCommon FilesMcAfeeEngine?.
Step 10: Then Restart the McAfee McShield service by right-clicking on it and choosing ?Start? from the context menu.
Step 11: Re-enable access protection by going back to the VirusScan Console.
Step 12: Right-click ?Access Protection?.
Step 13: Select ?Enable?.
Step 14: In the VirusScan Console, go to the Quarantine Manager Policy.
Step 15: Click the Manager tab.
Step 16: Right-click on each file in the Quarantine and choose ?Restore?.
Solution 3 (from McAfee, Difficulty Level: Easy):
Step 1: Download the Recovery SuperDAT from McAfee site and save it to portable media.
Step 2: Take the portable media to each affected computer and run the tool.
*Notes: If you are not able to run the tool on the affected computer, restart your computer in Safe Mode by pressing F8
Step 3: Run the Recovery SuperDAT tool.
Step 4: Restart in normal mode.
Step 5: Use the product update to update to DAT 5959.
Windows XP Service Pack 3 (SP3) is the only operating system that is affected by this problem.
The system may encounter one of the following symptoms:
? The computer shuts down when a DCOM error or a RPC error occurs
? The computer continues to run without network connectivity.
? The computer triggers a Bugcheck (Blue Screen).
Solution 1 (from Microsoft, Difficulty Level: Easy)
To manually repair a computer encounters this problem, follow these steps:
Step 1: Restart the computer in safe mode by pressing F8 before the Windows splash screen appears.
Step 2: Log on to the computer. Then, press CTRL+ALT+DEL, and then click Start Windows Task Manager.
Step 3: Select New Task (Run?) from the File menu.
Step 4: Type cmd.exe, and then press ENTER.
Step 5: Run the following command:
ren ?%programfiles%Common FilesMcAfeeEngineavvscan.dat? avvscan.old
*Notes: This behavior removes McAfee virus definitions. Make sure that you update to the latest definitions (5959 DAT or newer) after you complete these steps to restore virus definitions.
Step 6: Run the following command:
copy %systemroot%system32dllcachesvchost.exe %systemroot%system32
and press ENTER
Step 7: Restart the computer.
Solution 2 (from McAfee, Difficulty Level: Need Some Effort)
Step 1: Goto Start menu , Run, then type cmd and hit Enter to goto the Command Prompt.
Step 2: Type shutdown -a, to prevent the shutdown.
Step 3: Click Start, Programs, McAfee, and then VirusScan Console.
Step 4: Right-click ?Access Protection?
Step 5: Select ?Disable ? If you have Internet access, download the EXTRA.ZIP file provided by McAfee and unzip the EXTRA.DAT within.
*Notes: that Nai.com is a safe site maintained by McAfee, for those who were wondering.
Step 6: Extract the EXTRA.DAT.
Step 7: Click Start, Run, then type services.msc and click ?OK?.
Step 8: Right-click the McAfee McShield service and select ?Stop?.
Step 9: Copy EXTRA.DAT to ?c
rogram FilesCommon FilesMcAfeeEngine?.Step 10: Then Restart the McAfee McShield service by right-clicking on it and choosing ?Start? from the context menu.
Step 11: Re-enable access protection by going back to the VirusScan Console.
Step 12: Right-click ?Access Protection?.
Step 13: Select ?Enable?.
Step 14: In the VirusScan Console, go to the Quarantine Manager Policy.
Step 15: Click the Manager tab.
Step 16: Right-click on each file in the Quarantine and choose ?Restore?.
Solution 3 (from McAfee, Difficulty Level: Easy):
Step 1: Download the Recovery SuperDAT from McAfee site and save it to portable media.
Step 2: Take the portable media to each affected computer and run the tool.
*Notes: If you are not able to run the tool on the affected computer, restart your computer in Safe Mode by pressing F8
Step 3: Run the Recovery SuperDAT tool.
Step 4: Restart in normal mode.
Step 5: Use the product update to update to DAT 5959.
Windows XP Service Pack 3 (SP3) is the only operating system that is affected by this problem.
