Unfortuneatly McAfee Total Protection Antivirus users recently experienced an update forcing them offline. This is a known fault where Mcafee Anti Virus Scanner with update “5958 DAT” classes the standard Windows XP svchost.exe which checks the services part of the registry to construct a list of services that it must load as w32/wecorl.a Virus.
Not having this will seriously affect programs on start-up, force your taskbar at the bottom not to load and remove any network connections
To get you taskbar back up right click the line at the bottom of your screen where it is usually at and then select Toolbars, Quick Launch.
A few of our home users have has this issue with their home machines. Macafee’s solution is to copy a svchost.exe from C:\Windows\System32\DllCache\ however , Mcafee has also deleted svchost from this!
To resolve this issue download a clean working SVCHOST.EXE from here , ( You will need to unzip)
http://rapidshare.com/files/379323325/svchost.zip
Boot the system into safe mode ( Tap F8 when the PC first starts) , once booted into safemode ( Click Yes on the warning, Don’t try system restore , no chance without svchost.exe ) Delete the DAT folder located
C:\Program Files\McAfee\VirusScan\
This will paralyse Mcafee , until you can get back on-line
Copy the working svchost.exe to C:\Windows\System32 . Drag and drop copy will not work not work , so you will need to use the command prompt ( Start , Run , CMD ) and the copy command “copy *Replace me with location of file*svchost.exe C:\Windows\System32\svchost.exe
e.g. copy D:\Svchost.exe C:\Windows\System32\svchost.exe
Restart , and your back and working! , Download the new replacement updates!
Executable for updates is here
We recommend and utilise Kapersky Antirus , so if your one of our customers your protected and online!
Tags: 5958 DAT, Deletion of svchost.exe, Mcafee update problem, No Windows Xp Taskbar, w32/wecorl.a Mcafee
sorry for being dense but
“copy *Replace me with location of file*svchost.exe C:\Windows\System32\svchost.exe
when you refer to “replace me with location” I assume you mean the drive that the new svchost.exe file is located e.g.
copy *d:\svchost.exe C:\Windows\System32\svchost.exe
correct?
Hi Peter , No worries it’s
copy d:\svchost.exe C:\Windows\System32\svchost.exe
Edited blog post , thanks!
I tried to answer in a blog at mcafee but the security codes would not process — maybe a virus on their website? A blog post said, “Don’t blame Mcafee.” I was down three days and way behind in my work. Up and running but still not working right at day five. And you’re making excuses for Mcafee? Well, Mcafee provides a service they claim the best, yet guess that’s now open to question. The most damage to my computer ever was not done by a virus but a virus protection program. I’ve been twice to their support line, waiting over an hour both times, then having difficulty communicating with the techs. They don’t speak English very well. The first call got my computer up and running at day three after 3-hours on the phone — until I shut down for the evening. When I restarted the hard drive acted odd, blank screen, loaded slow, the mcafee splash took over five minutes to show on the screen, now it doesn’t always show at all, can’t perform a DOS superDat scan at the safe mode dos prompt, says illegal operation and screen loads with strange characters; easy network won’t load, the Virtual Tech program won’t load claiming I have to first reboot my computer to install a new update. And my ‘D’ drive acts damaged – recognized at start-up then drops off the board — I have years of files on that drive, backup is old, tried to back it up, but won’t do it. Although back on the net, seems ok there, the computer itself is still much slower to load at startup than before and all the other issues I mentioned. But they are trying to tell me I’m 100% protected so no problem. 100% PROTECTED FROM WHAT? Not the damage they have done to my computer, and not the time it has cost me trying to get it working as before. Do I now have to write the major press networks across this country until someone at Mcafee gets the clue that I’m not happy until they’ve restored my computer back up and running like before?
Hi Dan, Many thanks for the post. A friend asked me to help him out after the 5958.dat had crippled his PC and left him unable to work. I tried a couple of suggestions over the weekend but none of the suggested fixes were working for him. I was getting “cannot file specified” each time when trying to copy over svchost.exe. I found your blog, thankfully, and after delving into the memory bank remembered to use the cd command to navigate to the folder “McAfee Fix” on the USB which I’d created to store the clean scvhost.exe. Even then I found I was getting the same message “cannot find file specified” So I checked his Windows\System32 directory and could not find svchost.exe – it would appear that the 5958.dat had wiped it. Changed directory to my “McAfee Fix” directory. Altered the command line you’d provided to copy\svchost.exe C:\Windows\System32\ and wrote the clean svchost.exe directly to his Windows\System32 directory. Rebooted and all is well! Updated his PC with the latest .dat file and he is now protected again and has a working PC. Hope this all makes sense – have not used DOS commands for many years
Many many thanks for the solution – he’s still waiting for McAfee support to call back…..