Yesterday, Windows XP computers that made an update to the 5958 DAT file for their virus scanner suffered catastrophic problems. They ranged from the system crashing with the infamous blue screen, constant rebooting, and losing connection to their networks. These problems only occured with computers running Windows XP which had Service Pack 3 installed. Windows Vista and Windows 7 were not affected by the 5958 DAT file.

Network connectivity loss was another bug that occurred. Even though the network card was visible, the settings in Network Connections was gone. You couldn’t even view the properties of the network card to test it if was working correctly.

I spent quite a bit of time trying to figure out what broke on several infected computers. At first, I considered that it may be a virus attacking these machines which got past the McAfee scanner. It was only a couple of hours later that I was made aware that the problems were caused by buggy coding in the 5958 DAT file. The Windows XP machines that automatically updated to this version experienced the same problems that many thousands of other computers did around the world.

McAfee released the 5959 DAT file a few hours later which fixed the 5958 bugs. Installing this DAT file won’t fix computers that were damaged by 5958. They issued a procedure, False positive detection of w32/wecorl.a in 5958 DAT, which describes in detail how to fix broken Windows XP systems.

I was able to fix the damaged PC’s with McAfee’s fix, but I couldn’t follow their procedure in several instances. The reason was that the Taskbar was corrupted in a few systems and I couldn’t use the Start menu or right click the McAfee virus scanner icon.

In Workaround 1, you need to run the VirusScan Console from the Start menu. If the Start menu isn’t available, open Windows Explorer (press the Windows key and E), go to the folder with the virus scanner (i.e. \Program Files\McAfee\VirusScan Enterprise) and run mcconsol.exe. This will give you the VirusScan Console so that you can toggle Access Protection.

On the systems that I fixed, drag-and-drop and cut-and-paste in Windows Explorer didn’t work. In order to copy the EXTRA.DAT and svchost.exe files to their required folders, you have to use the Command Shell. Press the Windows key and R. Then type cmd in the dialog box and you’ll be in the command prompt. From there, navigate to the folder by typing

    cd “C:\Program Files\Common Files\McAfee\Engine”

        or

    cd “C:\Windows\System32”

This depends on which file is being copied and also where the virus scanner was installed. Use the copy command to copy the file to the folder, i.e.

    copy E:\EXTRA.DAT

After these procedures are complete, the computer will work correctly.

Tweet This Post!

Related posts:
	Test Your Virus Scanner With EICAR Thunderbird: Connection to Server Time Out Error Preventing Deletions in Attached E-mail Files Microsoft Security Essentials 2.0 Update

Share this post:

               

Follow Me:

Did you find this post interesting and useful? You can keep up to date on this blog by subscribing to my RSS feed, or you can have new posts sent to you by e-mail. You can also follow me on Twitter.

1 Comment »

Trackback This Post | Subscribe to the comments through RSS Feed