Jump to content



Photo

mcafee virusscan enterprise


  • Please log in to reply
31 replies to this topic

#1 u2_storm

u2_storm

    Some IT person...

  • 388 posts
  • Joined: 29-March 05
  • Location: Mobile Worker,UK

Posted 21 April 2010 - 15:30

McAfee Virus Scan Killing SVCHOST.exe
If you have updated to Dat 5958 today your computer will reboot and you may not be able to use your computer.

We have thousands of computers affected and a team are working to get it fixed by downgrading to 5957 and restoring SVChost.exe


Is anyone having issues with mcafee virusscan enterprise 8.7i?


#2 OP u2_storm

u2_storm

    Some IT person...

  • 388 posts
  • Joined: 29-March 05
  • Location: Mobile Worker,UK

Posted 21 April 2010 - 15:38

Anyone at all? This is getting fairly big!

#3 Phenom II

Phenom II

    Neowin Junkie

  • 4,808 posts
  • Joined: 19-October 06
  • Location: , Location, Location

Posted 21 April 2010 - 15:41

When you say shutting down, do you mean Mcafee is shutting them down ?

Have you checked the machines Event Logs ?

#4 Stup0t

Stup0t

    Neowinian

  • 460 posts
  • Joined: 08-August 07
  • Location: UK
  • OS: Windows 8.1 Pro x64
  • Phone: Nokia Lumina 520

Posted 21 April 2010 - 15:43

Anyone at all? This is getting fairly big!



Yes basically, what ever you do do not reboot yours system if you managed to do the shutdown -a command to stop it as its kills ye pc and network.

#5 OP u2_storm

u2_storm

    Some IT person...

  • 388 posts
  • Joined: 29-March 05
  • Location: Mobile Worker,UK

Posted 21 April 2010 - 15:43

http://www.google.co...nk&ved=0CB0QpwU

VirusScan dat file 5958

It seems to kill SVCHOST.exe

#6 OP u2_storm

u2_storm

    Some IT person...

  • 388 posts
  • Joined: 29-March 05
  • Location: Mobile Worker,UK

Posted 21 April 2010 - 15:57

If anyone had Mcafee EPO running shut it down.... Anyone else any updates?

#7 OP u2_storm

u2_storm

    Some IT person...

  • 388 posts
  • Joined: 29-March 05
  • Location: Mobile Worker,UK

Posted 21 April 2010 - 16:03

We have received thousands of reports indicating some issues with McAfee DAT 5958 causing Windows XP SP3 clients to be locked out. Any fixes anyone?
One fix is that we change the dat, no update yet.

#8 OP u2_storm

u2_storm

    Some IT person...

  • 388 posts
  • Joined: 29-March 05
  • Location: Mobile Worker,UK

Posted 21 April 2010 - 16:08

sorry to bump but this is affecting all Mcafee av's for our clients.

#9 YaZoR

YaZoR

    Budgie Smuggler

  • 1,628 posts
  • Joined: 26-September 02
  • Location: England

Posted 21 April 2010 - 16:09

I've had many sites affected by this.

Windows XP SP3
McAfee VirusScan Enterprise 8.5 & 8.7

Taskbar disappears, no start button, no network connections.
Unable to view events in event viewer also.

I hear McAfee are rolling a new update very soon.... but how to remotely update a PC which has had it's network b0rked?
Nice. Can't wait for work tomorrow!

#10 OP u2_storm

u2_storm

    Some IT person...

  • 388 posts
  • Joined: 29-March 05
  • Location: Mobile Worker,UK

Posted 21 April 2010 - 16:11

If anyone can stop there McAfee from updating do so otherwise your SVChost.exe file will be 0KB

#11 OP u2_storm

u2_storm

    Some IT person...

  • 388 posts
  • Joined: 29-March 05
  • Location: Mobile Worker,UK

Posted 21 April 2010 - 16:18

@YaZoR We are working on a fix here for our clients. but it may be replacing SVHost on tons of machines...

#12 Panacik

Panacik

    Little man

  • 10,665 posts
  • Joined: 30-September 03

Posted 21 April 2010 - 16:36

How about starting the machine in safe mode? Does that work? If so, can you have them remove the latest DAT file? If not, can you ahve them remove the antivirus and then talk them through re-installing?

Last known config? Does that restore the dat to the old version?

Have you tried speaking to Mcaffee about this at all? Are they working on a DAT update or patch? If so, when its released, can you boot to safe mode and install it?

If the machine starts and simply starts shutting down, have the user run the command "shutdown -a" as mentioned above. Does that stop it from restarting?

#13 OP u2_storm

u2_storm

    Some IT person...

  • 388 posts
  • Joined: 29-March 05
  • Location: Mobile Worker,UK

Posted 21 April 2010 - 16:38

It's too late for most people to do the shutdown -a
We are having sucess with installing an old superdat
will keep you updated.

#14 ZeroHour

ZeroHour

    Neowinian

  • 770 posts
  • Joined: 30-April 04
  • Location: Scotland

Posted 21 April 2010 - 16:41

I take it from all this that the lastest defintions mark the svchost.exe as a virus and try to quarantine it?

#15 Panacik

Panacik

    Little man

  • 10,665 posts
  • Joined: 30-September 03

Posted 21 April 2010 - 17:07

I really dont understand what U2_Storm was posting so much for?

I thought he wanted help, but now i think he is trying to give us advise?

I use Sophos here, so it doesnt effect me... I used to use McAffee in another company though... Both products seem to fail in their own way to be honest.