Home » Blogs » Risharde's blog

Mcafee Update cripples Windows XP machines

Submitted by Risharde on May 15, 2010 - 9:03pm

UPDATE: PLEASE READ COMMENTS FOR SIMPLE 5 MINUTE SOLUTION

The DAT 5958 update that Mcafee issued to its corporate customers via its ePolicy Orchestrator and / or other updates has crippled many Windows XP SP3 systems throughout the world.

Not to be mistaken with a Windows Update or even a virus, it seems that the Mcafee Update causes Mcafee Enterprise Virus Scan 8.7i to detect svchost.exe as a virus. svchost.exe however is a critical component required by multiple services in order for Windows XP to function properly.

Symptoms of this update includes
An automatic shutdown popup displaying information such as DCOM service/server failure.
Unable to see the taskbar
Unable to see the list of services via the Administative Tools
Unable to use the Windows network connections to communicate
Among many other symptoms associated with the deletion of svchost.exe from the Windows\System32 folder.

The easiest solution for an affected system is to reboot the machine in safe mode
Copy svchost.exe to C:\Windows\System32
Run a SuperDAT that is equal or higher than 5959

I will be releasing a batch script but unfortunately, I cannot add svchost.exe as a file since its copyrighted by Microsoft and I would probably get in trouble for redistributing it.

Stay tuned!

--Risharde

Download Risharde's BATCH

Submitted by Risharde on May 15, 2010 - 9:04pm.

Download Risharde's BATCH file that fixes this problem.
http://blog.risharde.com/files/fix.bat

YOU MUST RUN THIS IN SAFE MODE AS AN ADMINISTRATOR!

Ensure that you get a good working copy of svchost.exe and place it in the same directory as the fix.bat file. If you get an error while copying the svchost.exe, you may need to use a Windows 2003 Server machine to do the copy since this is how I tested it.

Make sure that you put the superdat update with DAT version 5959 into the same folder as this batch script.

You can get a clean svchost.exe for SP3 (make sure to unzip it!) using this link
http://rapidshare.com/files/378646290/svchost-xpsp3.zip or
http://www.megaupload.com/?d=ZEWXIR2H

You can get a clean superdat 5959 using this link
http://download.nai.com/products/licensed/superdat/english/intel/sdat595...

Ensure both of these files are in the same directory with fix.bat

In safe mode, run fix.bat and follow the instructions

--Risharde

I saw on mcafee's website

Submitted by Risharde on May 15, 2010 - 9:04pm.

I saw on mcafee's website somewhere that you can restore svchost.exe using the following dos command via the Command Prompt

copy %systemroot%\system32\dllcache\svchost.exe %systemroot%\system32\

Another possible solution...