[Riley]

Thanks for that. I had a mystery case come in late this afternoon, and this pretty much describes it. I’ll fix it when I get in tomorrow AM.

[Bloody Sam Roberts]

No problemo.

I also found a new .dat file available from Macafee that you might want to apply. Because it is possible for Macafee to re-delete svchost.exe after you do the fix. I've seen that happen today several times.

Here is the link to it:
http://www.mcafee.com/apps/downloads/security_updates/dat.asp?region=us&segment=enterprise

Try running it with /F switch and also re-doing the "expand" command fix for C:\winnt\system32\svchost.exe.

here is some additional info I just received:

It appears that a threat called w32/wecorl.a has bound itself to svchost.exe and McAfee update 5958 finds the threat but also deletes svchost.exe.
Some known symptoms or infection and/or having lost svchost.exe:

• you're unable to paste
• your Taskbar has disappeared or been made to look like a Classic Mode setup
• you see nothing in Network Connections
• you cannot obtain an IP address

The definition update at the link is for Macafee update 5959.