McAfee update causes Windows reboot loop

The 5958 DAT anti-virus update issued on Wednesday 21st April 2010 has a false positive detection of the virus w32/wecorl.a. The significance of this being that it quarantines the svchost.exe file on any machine running Windows XP Professional Service Pack 3, a file critical for Windows to operate.

McAfee have issued a 5959 update that corrects the problem, however many users have already received the corrupt 5958 update. If you have received the 5958 update and your machine is rebooting itself in a constant loop, here are the instructions for fixing the problem :

• Choose Start then Run and type ‘cmd’ and hit Enter
• Then type ‘shutdown -a’
• This should prevent the automatic rebooting and allow you to further troubleshoot
• Next you need to disable both “Access Protection” and “On-Access Scanner” from the Start Menu – Programs – McAfee – VirusScan Console
• Right-click both “Access Protection” and “On-Access Scanner” and select Disable
• You need to then download the extra.zip file from McAfee either on the machine in question or another machine
• Open the .zip file and extract the contents to a folder of your choice
• Choose Start – Run
• Type ‘services.msc’ and hit Enter
• Right-click on the “McAfee McShield” service and select “Stop”
• Copy the extra.dat file extracted earlier to the \Program Files\Common Files\McAfee\Engine folder on your machine
• Right-click on the “McAfee McShield” service select “Start”
• Return to the VirusScan Console (Start Menu – Programs – McAfee – VirusScan Console)
• Right-click on “Access Protection” and select Enable
• Now select the “Quarantine Manager” and restore the svchost file that you find there (right-click and choose Restore)
• Finally you will need to re-enable the “On-Access Scanner”

Please contact us if you require any assistance with this or any other issues.