McAfee antivirus program goes berserk, freezes PCs

NPR ^ | 4/21/2010 | Staff

[Migraine]

Takes a while to find out how to shut the voice up. "You're anti virus database has been updated." Was driving me nuts.

The new version of that voice is that of a demure girl. Used to be a male dweeb's voice -- that one really ticked me off. I'm a big fan of Avast. Have been for about 8 years.

[Calm_Cool_and_Elected]

McAfee ping!

[smokingfrog]

as per - http://isc.sans.org/diary.html

The problem is a false positive which identifies a regular Windows binary, “svchost.exe”, as “W32/Wecorl.a”, a virus. If you are affected, you will see a message like:

The file C:WINDOWS\system32\svchost.exe contains the W32/Wecorl.a Virus.
Undetermined clean error, OAS denied access and continued.
Detected using Scan engine version 5400.1158 DAT version 5958.0000.

McAfee released an updated DAT file, and an “EXTRA.DAT” file to fix the problem. An EXTRA.DAT file is a patch to just fix the bad signature. McAfee’s support web sites currently respond slowly and are down at times, likely due to the increased load caused by this issue.

Several readers reported that this procedure worked to recover:

1 - Boot the system in “Safe Mode”
2 - copy extra.dat in c:/program files/common files/mcafee/engine
3 - reboot.

If you lost “svchost.exe”, then you need to copy it back to c:/Windows/system32/svchost.exe while in safe mode. This fix has to be applied locally at the workstation. However, it may be possible to do this remotely if your workstations support Intel’s “vPro” technology. We should have a link to instructions shortly.

Our reader Jim wrote in about how he managed to get some systems back remotely, as long as svchost.exe was not deleted or moved. In this case, the computer will be in a reboot loop. Here is what Jim wrote:

I created a batch file to run the following command:

echo f | xcopy.exe {server}netlogonextra.dat
“c:program files\common files\mcafeeengine\extra.dat” /R /Y

I put this batch file and the extra.dat in the netlogon folder.

I then set the computer configuration>windows settings>scripts>startup to run this command in a GPO that gets applied to all computers. Then link the GPO to the domain root, or wherever is appropriate.

Upon reboot the computers process this command and so far we seem to be good to go, “mostly”. There have been a few cases where the files end up missing.

[TrumpisRight]

HEHEHEHE!

[ml/nj]

Has a very small footprint (you won’t know it’s there, or running).

Yeah. As long as you don't ever intend to use your computer until ten minutes after you turn it on. Randomly it seems to do something (update, scan, who knows?) once or twice a week that effectively renders my computer useless. It would be nice if they asked when I want them to do whatever it is they do like with the OS updates.

ML/NJ

[Kid Shelleen]

>>Let me take a moment to suggest that people take a look at Microsoft Security Essentials <<

I have been using it. I know some tech savvy people who like it and it has been getting some good reviews.

[Windflier]

...take a look at Microsoft Security Essentials.

Any idea how it stacks up against Avira (free) anti-virus?

I started using Avira about a year ago, after something went bonkers with my free AVG program. It's been very stable and has kept me almost 100% bug free.

Malwarebytes will sometimes catch something that Avira missed, but only sometimes. Avira's been pretty good.

[LibFreeOrDie]

My office emptied out for a nice long lunch. Thank you, McAfee!

[LibFreeOrDie]

In a word... Kaspersky

I ditched Norton and McAfee for Kaspersky, and was happy with it until recently. The mouse on my Vista 64-bit machine suddenly wasn't being recognized by the computer. I thought it was a bad MS update. Turns out that a recent Kaspersky update assigns its klfltdev.sys file as the mouse driver! And it hoses the USB ports. Based on what I've read on the Kaspersky forums, this has happened before. Not sure why it never happened on my machine before now.

[aimhigh]

MaximumPC Magazine just came out with their Anti-virus reviews. Good article.

http://www.maximumpc.com/article/features/kill

ESET Smart Security got high marks. The Microsoft product also did a good job, but it was marked down for taking such a long time to complete a hard drive scan.

[JDoutrider]

Interesting that...

Have yet to have any problem with the Kas, I'll have to keep an eye out for that ripple... thanks!

[TChris]

IF Malwarebytes went into the AV instead of only Malware, everyone will be bankrupt.

Yup. I used MWB as one of my main cleanup tools. Very good stuff, that.

[Hodar]

It would be nice if they asked when I want them to do whatever it is they do like with the OS updates.

Check under the 'Settings' tab. You can tell it when to scan, and when to check for updates. I've got mine set for Sunday at 2am; and I've never had a problem like you discuss.

However, I had that problem frequently with Avast!, as that used to really irritate me, in that it would take over my machine for 5 minutes after each re-boot.

[ml/nj]

I've got mine set for Sunday at 2am

Same here. (It must be the default setting!)

ML/NJ