Welcome to RCF - WHF

Nightrider · Sep 25, 2004

McAfee antivirus program goes berserk, reboots PCs

NEW YORK (AP) - Computers in companies, hospitals and schools around the world got stuck repeatedly rebooting themselves Wednesday after an antivirus program identified a normal Windows file as a virus.

Antivirus vendor McAfee Inc. confirmed that a software update caused its antivirus program for corporate customers to misidentify a harmless file. It has posted a replacement update for download.

Online posts indicated that thousands of computers running Windows XP with Service Pack 3 were affected.

More...

Shocked

rb2d2 · Sep 25, 2004

How to fix your McAfee-crippled computer

If your computer is shutting down automatically, you must address that before you can fix anything else.

# Step 1: Open a command prompt: Start menu, Run, then type cmd and hit Enter
# Step 2: Type shutdown -a, which will prevent the shutdown from occurring

McAfee has revealed two fixes for the problem. Each one requires multiple steps, and can be confusing. If you're not comfortable with advanced computer fixes, you should get help with this.

For the first fix, go to the McAfee interface through the Start menu, and disable Access Protection and On-Access Scanner.

# Step 1: Click Start, Programs, McAfee, and then VirusScan Console
# Step 2: Right-click "Access Protection"
# Step 3: Select "Disable"

If you have Internet access, download the EXTRA.ZIP file provided by McAfee and unzip the EXTRA.DAT within. (Note that Nai.com is a safe site maintained by McAfee, for those who were wondering.) Once EXTRA.DAT has been extracted:

# Step 1: Click Start, Run, then type services.msc and click "OK"
# Step 2: Right-click the McAfee McShield service and select "Stop"
# Step 3: Copy EXTRA.DAT to "\Program Files\Common Files\McAfee\Engine"
# Step 4: Then restart the McAfee McShield service by right-clicking on it and choosing "Start" from the context menu
# Step 5: Re-enable access protection by going back to the VirusScan Console
# Step 6: Right-click "Access Protection"
# Step 7: Select "Enable"
# Step 8: In the VirusScan Console, go to the Quarantine Manager Policy
# Step 9: Click the Manager tab
# Step 10: Right-click on each file in the Quarantine and choose "Restore"

There is, of course, one massive hang-up with this McAfee-recommended solution: More likely than not, you don't have Internet access on your McAfee-borked computer. In fact, it's highly unlikely that you have access to much of anything, since deleting SVCHOST.EXE prevents key Windows 32-bit sub-system processes from functioning at all. To get the EXTRA.DAT on your computer, you'll probably have to download it on an unaffected computer, then copy it to either a USB drive or a CD-ROM and use the command prompt to copy it over to your C: drive.

The second workaround requires that you apply the EXTRA.DAT fix as detailed above before beginning and that you have access to a second, unaffected Windows XP computer. On that computer, go to C:\WINDOWS\system32 and copy SVCHOST.EXE to a network location or a removable media device such as a USB stick. Then copy the SVCHOST.EXE from the unaffected computer to the affected computer, and restart the McAfee-afflicted computer. There are details on applying the EXTRA.DAT via ePolicy Orchestrator at McAfee's fix on Nai.com.

Severe problems caused by buggy or false positive security updates are rare, but not unheard of. Recent instances include an update from Avast that marked hundreds of legitimate files as threats in December 2009, Computer Associates flagging a Windows system file as a virus in July 2009, and AVG marking ZoneAlarm as malware in October 2008.

McAfee did not immediately responded to a request for comment.

cat1