Whoopsie, here we go again.. antivirus kills Windows

By rzomerman | | No Comments | Other

Once in a while, antivirus companies create a new signature file that kinda stops the entire system instead of just the virus..

It’s like the docter amputates the heart of the patient, just to cure a brooze

Congratulations McAffee this time:

Problem
Blue screen or DCOM error, followed by shutdown messages after updating to the 5958 DAT on April 21, 2010.
Solution
WARNING: If you have not done so already, do NOT download the 5958 DAT and disable all automatic pull and update tasks.

Workaround 1
McAfee has developed an EXTRA.DAT to suppress this detection. The file is attached to this article. This EXTRA.DAT does not fix the issue, it only suppresses the detection.

Apply the EXTRA.DAT to all potentially affected systems as soon as possible.

For systems that have already encountered this issue, start the computer in Safe Mode and apply the EXTRA.DAT. After applying the EXTRA.DAT, restore the affected files from Quarantine.

To apply the EXTRA.DAT locally:

IMPORTANT: For VirusScan Enterprise 8.5i and later,  an Access Protection feature must be temporarily disabled before proceeding.  For instructions on how to temporarily disable Access Protection in the VirusScan Console, see KB52204.

To apply the EXTRA.DAT locally:

  1. Download the EXTRA.ZIP file attached to this article and extract the EXTRA.DAT file.
  2. Click Start, Run, type services.msc and click OK.
  3. Right-click the McAfee McShield service and select Stop.
  4. Copy the EXTRA.DAT file to the following location:<installation drive>Program FilesCommon FilesMcAfeeEngine

  5. In the Services window, right-click McAfee McShield and select Start.
For instructions on how to deploy the EXTRA.DAT through ePolicy Orchestrator (ePO), see:

To restore files from Quarantine locally:
  1. Open the VirusScan Console.
  2. Double-click Quarantine Manager Policy.
  3. Click the Manager tab.
  4. Right-click the required item and select Restore.
For additional information, see the VirusScan Enterprise Product Guide for your version of VirusScan Enterprise.