How to fix McAfee VirusScan Corporate update error.

McAfee Update Issue – Affecting corporate users world wide

McAfee released an Anti Virus update early morning on Wednesday 21st April that falsely detects a core windows file, svchost.exe as a virus. It then quarantines or deletes the file causing windows to become essentially useless.

This problem seems to be only affecting Windows XP SP3 machines at the moment.

Some of the symptoms of the affected PC’s are:

• Loss of Task Bar and Start Menu
• Unable to connect to the network or internet

This has been a major problem for many companies as the current fix, at least right now, requires each machine to be touched by IT, in person, to repair the bad update as well as the svchost.exe file. As can be imagined, when faced with automatic updates across a company of hundreds or thousands of users, an IT department quickly has a major headache on their hands.

This is adding to the frustration and is causing delays resolving the problem.

If you are struck with this problem, and feel confident enough, you can fix this problem yourself, taking the strain off of your IT department and also getting yourself back up and running again.

Please note: Although straight forward, you will be accessing windows system files and as such due care and caution are advised. Please read through this guide thouroghly before attempting to perform this fix. If at any stage you are unsure, seek professional advice.

This guide has been adapted from the official McAfee Document – False positive detection of w32/wecorl.a in 5958 DAT (for Corporate/Business users) – VirusScan Enterprise found at http://vil.nai.com/vil/5958_false.htm

To fix the problem

What you need:

• A working PC with internet access
• A usb stick/pendrive

Step 1 – Download

1. Then download the Updated DAT file which is available from the McAfee Security Updates page at: http://www.mcafee.com/apps/downloads/security_updates/dat.asp?region=us&segment=enterprise and save it to your USB Stick

Step 2 – Recovery

1. Boot up the affected PC and insert the USB Stick
2. Access Windows Task Manager by pressing Ctrl – Alt – Del on the keyboard
3. From the File menu choose New Task (Run…)
4. In the Create New Task box, Type explorer.exe and then press Enter
5. This should bring up a windows explorer window that you can then use to navigate to the file system.
6. Navigate to your USB Stick and double Click on the DAT update file that you downloaded earlier.
7. Follow the instructions on screen to complete the update.
8. Once complete, using the Windows Task Manager, once again from the File menu choose New Task (Run…)
9. In the Create New Task box, Type “C:\program files\mcafee\virusscan enterprise\mcconsol.exe” /standalone and then press Enter
10. This will bring up the management console for McAfee Virus Scan
11. Double-click Quarantine Manager Policy, then click the Manager tab.
12. Right-click the detection and select Restore.
13. Restart your computer by using Windows Task Manager and from the file menu choosing Shutdown > Restart

That should get you up and running. If you are still having problems or would like someone else to do this for you, please get in touch