McAfee pushed out a malformed security patch early on Wednesday that wound up crippling computers running Windows XP, but there is a fix available. Users should note that it's labour-intensive and must be applied manually to each computer. If you're running Windows Vista or Windows 7, your computer shouldn't be affected by the bad update.
As of 11am AEST Thursday, McAfee.com.au had yet to provide a link on its front door to a fix for a false positive update with disastrous consequences for those on Windows XP that went out Wednesday.(Screenshot/CNET Australia)
If your computer is shutting down automatically, you must address that before you can fix anything else. Open a command prompt (Start menu, Run, then type cmd and hit Enter) and type shutdown -a, which will prevent the shut down from occurring.
McAfee has revealed two fixes for the problem. Each one requires multiple steps and unfortunately none so far involves a simple update patch from McAfee.
For the first fix, go to the McAfee interface through the Start menu and disable Access Protection and On-Access Scanner. Click Start, Programs, McAfee and then VirusScan Console. Right-click "Access Protection" and select Disable.
Then download the extra.zip file provided by McAfee and unzip the EXTRA.DAT within. (Nai.com is a safe site maintained by McAfee, for those who were wondering.) Click Start, Run, type services.msc and click "OK". Right-click the McAfee McShield service and select "Stop". Copy extra.dat to \Program Files\Common Files\McAfee\Engine. Then restart the McAfee McShield service by right-clicking on it and choosing "Start" from the context menu.
After that, you must re-enable access protection by going back to the VirusScan Console, right-click Access Protection and select Enable. Then go to the Quarantine Manager and restore the files that you find there. Restore can be initiated from either the toolbar or by right-clicking on the file and choosing "Restore" from the context menu.
From the VirusScan Console, double-click Quarantine Manager Policy, click the Manager tab, right-click the required item and select "Restore".
The second workaround requires that you apply the extra.dat fix as detailed above before beginning and that you have access to a second, unaffected Windows XP computer. On that computer, go to C:\WINDOWS\system32 and copy svchost.exe to a network location or a removable media device such as a USB stick. Then copy the svchost.exe from the unaffected computer to the affected computer and restart the McAfee-afflicted computer. There are details on applying the extra.dat via ePolicy Orchestrator at McAfee's fix on Nai.com.
Severe problems caused by buggy updates are rare but not unheard of. Recent instances include an update from Avast that marked hundreds of legitimate files as threats in December 2009, Computer Associates flagging a Windows system file as a virus in July 2009, and AVG marking ZoneAlarm as malware in October 2008.
Via Downloads.com
Add Your Comment 4