Attn: McAfee Representatives (only please)
I checked it out, and I do have the DAT 5959 version, completed by McAfee automatic update.
Now my question is...(when) will it be safe to run a scan on your PC again? In other words, did the McAfee DAT 5959 (auto update/fix-it) solve "all" the known issues to McAfee Security software users? Thanks, and I await your reply.
Message was edited by: aivie on 4/22/10 9:06:36 AM CDTI'm the original poster who had a problem with dat 5958. When I did a manual scan it stopped at svchost.exe and then rebooted. I was able to use the internet and my other programs, and still am able to boot the computer, so was not as bad off as some were. I have windows xp service pack 3.
I downloaded dat 5959 but have not attempted to scan with it, since I'm not sure if anything went wrong with the svchost.exe.
I did look for svchost.exe, using the little dog's help on win.xp, and found "svchost.exe-3530F672.pf" when I hover the mouse over it, It says: "date modified 4/21/10 1:34PM size 22.8 kb" Does that mean it's corrupted? Or is it not really the svchost.exe file? Or maybe empty?
The path I wrote down is C:\windows\prefetchtype pf file (maybe not quite right in my notes reproduced here)
Any advice on what my next steps should be?
Do I need to go to a computer technician?
Message was edited by: hopeless1 on 4/22/10 9:32:03 AM GMT-05:00
Message was edited by: hopeless1 on 4/22/10 9:34:36 AM GMT-05:00Well, it's been some hours work getting my two XP SP3 PC's online again !
After rebooting in safe mode, the SDAT5958_EM.exe did not solve the issue at all. I had to pull out the svchost.exe out of it's svchost.ex_ compressed version using the command prompt and the EXTRACT.EXE program, all this without having access to the task bar, it was locked away from the display ! Pfuuh ! Glad I have a 25 year PC experience ! Because none of the tips from the "Corporate Knowledgebase" actually had an accurate description that matched my PC's settings ...
Now, the windows part seems to be working more or less, but McAfee will not update, even when pressing the update button ; and it displays the 5960.0000 DAT version.
I'm not pleased at all, and still not confident the problems are now all gone.
I do believe McAfee should issue a more detailed explanatation message and fully apologize. Two PC's at home affected, two PC's affected at the office (only two I'd say, because most of them are turned off at night and not everybdy arrivers early every morning). That's much more tha 0,5% of PC's affected ! More like 66% at home and 10% at the office !
I give up. I'm absolutly not very clever on pc's, but my brother is and he tried to help me fix it for hours last night, but had to give up, so I thought I'd try to seek advice from anyone in here who's running McAfee too.
My XP SP3 is more damaged than I can find a thread about, it can't access internet, it won't allow me to open any programs - what do I do now?
My laptop is running Vista, and it's ok. It never got affected at all, as far as I know, but I followed the advice sent out by McAfee and downloaded the fix update today.
Try the solution posted here: http://community.mcafee.com/message/125846#125846
the problem is (much) more difficult to solve than described in the links that McAfee provides, or links posted here.
Basically there are two issues to solve : 1. update 5958 DAT, 2. restore SVCHOST.EXE
1) update the faulty 5958 dat file with the SDAT5958_EM.exe file. To do that you must :
1.0) go to any computer with a working internet browser, and download that file somewhere from the McAfee forum, the provided links do work, and copy to to a portable media (USB, CD, floppy,...)
1.1) go to the faulty PC and restart windows in safe mode, by pressing "F8" when windows starts. You must use an account with administrator rights. You may have to try several accounts before it works well !
1.2) run the SDAT5958_EM.exe from the removable drive (USB, CD, floppy,...) from within windows in safe mode. If you want to copy the file, be aware that Copy+Paste will not work until you've solved the SVCHOST.EXE problem (later on), so if you want to make a copy you gave to get a command prompt and type the copy instructions, just like in the old DOS days.
1.3) read the log, and see if there are error messages. If there are some, redo steps 1.1 and 1.2 with a different account.
2) restore SVCHOST.EXE :
2.0) Stay in the windows safe mode, or go back there if you left it.
2.1) Easiest is to copy the file from c:\windows\system32\ from another XP SP3 PC (if you can find one that has not ben affected) again on a removable drive. If that works, go to 2.4.
2.2) If 2.1 is not feasible, look in one of the directories that McAfee suggests,good luck ! (c:\windows\ServicePackFiles\I386, or c:\windows\system32\dllcache). My experience suggests that it's likely you will not find it there either. If it works, go to 2.4
2.3) If all above fails, I suggest you go to the c:\I386 directory, where normally resides, among all original windows files in a compacted form, a file called SVCHOST.EX_ (8 kbytes). Go there in a command window, and run "EXPAND svchost.* SVC1" This should create a subdirectory called SVC1 that will hold 4 files, one of them being SVCHOST.EX_ (14kbytes). Rename it to SVCHOST.EXE (if its size did inflate, not if it still has 8 kbytes)
2.4) copy SVCHOST.EXE to c:\windows\system32. From the command prompt, you'll have to type "copy c:\I386\SVC1\SVCHOST.EXE c:\windows\system32" Adapt the source directory according to the place where you actually found SVCHOST.EXE
3) that being done, reboot your PC, and you will normally get a normal windows working again. You'll only have to open your McAfee console and update the software to the most current DAT version (mine is now 5960).
4) Get yourself a drink, or something else you like very much. You deserve it.
Ce message a été modifié par: PaulPlak on 23/04/10 15:29:23 CDT
Ce message a été modifié par: PaulPlak on 23/04/10 15:30:55 CDT
Ce message a été modifié par: PaulPlak on 23/04/10 15:31:21 CDT
Ce message a été modifié par: PaulPlak on 24/04/10 02:35:22 CDTHi All,
That was the first post that helped me to solve the issue. Just two remarks from my side:
1) instead of EXTRACT I used EXPAND,
2) I played a little bit with folders and expanded svchost.ex_ directly to c:\windows\system32 and then renamed
Then, I had a drink 🙂
Kind regards,
Marek
Hi Marek, glad it helped you.
Sorry for the typo, EXPAND.EXE is the right one to use indeed.
Paul
I now realize not all PC manufacturers create a c:\i386 subdir, as far as I know, HP and Dell do this to make support issues easier.
This is an alternate method, if you do not have the luck to have a c:\386 subdir on your PC.
To restore SVCHOST.EXE, you can also try the commands explained here, coming from http://support.microsoft.com/kb/2025695/en-us/
Advanced Steps to recover a missing svchost.exe
I'd like to add the comment that you can do all these steps on another PC, except for step 5.
DO NOT PERFORM STEP 5 on a PC with a Windows version different from XP SP3.
You can copy the resulting \i386 subdirectory over to a portable media, and load it on the affected PC.
(I don't know what drive letter your portable media will have, I'll call it X:, you'll have to replace X with the correct drive letter on your PC for the USB key, Cd-rom or whatever portable media you have).
The command now becomes :
expand –r X:\i386\svchost.ex_ %systemroot%\system32\
Then reboot !
Good luck to everyone.
Having said this, I do not understand why McAfee does not ask a temporary licence from Microsoft to distribute the SVCHOST.EXE from a downloadable location, that would save considerable time and frustration from it's users. And the support page is still leading to http://service.mcafee.com/Error.aspx
This issue may also be affecting some Vista Home Basic machines. I have a laptop that became thoroughly corrupted right about the time of this DAT.
Also please note that there are many more people affected than you think. The corporate edition is available to all of DoD as a home use download which means you have thousands of non-IT professional people using the corporate edition which may be affected. Am trying to run the superDAT fix, but no luck so far. Computer is running extremely slow and external slots are not working.
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership: