Unable to use Windows after updating the DAT file

[Former Member]

ALERT: 5958 DAT Update Issue (For Home Users Only)


Introduction
Some McAfee customers have encountered issues when using Windows XP Service Pack 3, after receiving an updated virus signature file, made available on Wednesday, April 21st (DAT 5958). Issues may include repeat restarts, a missing taskbar, or loss of internet connectivity after updating your DAT file.

Using one of the procedures below may be your fastest path to resolution. However, McAfee is also ready to assist you by telephone if these procedures do not resolve your issue, or if you would prefer to work with a ‘live’ Support agent.

This article provides two methods for resolving the DAT file issue:

• A downloadable automation tool
   
• A list of manual steps

NOTE: If you are not experiencing any of the above issues McAfee recommends you manually update.
To manually update:

1. Right-click on the M icon in your taskbar
2. Select either Updates or Check for Updates.
   After the update completes, you will receive a message that your product has been updated, or that you are already up-to-date. No further action on your part is required.
    

To check your DAT version
The affected DAT version is 5958. Use the steps below to check your DAT version.

	Double-click the M icon in your taskbar. Click Navigation. Click About. The DAT version is located in the VirusScan section.
	Double-click the M icon in your taskbar. Click About. The DAT version is located in the VirusScan section.

Use the Automated Solution Tool
IMPORTANT: if you are using a wireless keyboard and can't get into Safe Mode, you will need to use a keyboard that connects with a cable.

1. From a working computer, download http://download.nai.com/products/mcafee-avert/tools/SDAT5958_EM.exe and save it to a removable media (eg: CDROM, floppy disk).
2. Start the affected computer in Safe Mode (When booting, press F8 and choose Safe Mode).
3. Take the media with the new file and insert it into the affected computer.  
4. Open My Computer and double-click the removable media you saved SDAT5958_EM.EXE to.
5. Double-click the SDAT5958_EM.EXE tool.
6. Click Next to begin the Wizard, then click Finish when prompted.
7. Restart the computer normally.
8. After the computer restarts, right-click the M icon and manually check for an update to get the new DAT files.

Using Manual Restoration Steps
Home users can use the following steps to restore SVCHOST.EXE on computers affected by DAT 5958.

NOTE: If you used the automated tool successfully, you do not need to perform the steps in this procedure.

1. Start your computer in Safe Mode (When starting press F8 and pick Safe Mode).
2. Open My Computer.
3. Navigate to C:\Program Files\McAfee\VirusScan\DAT\5958.0. 
4. Delete the files inside the 5958.0 folder (if there are any). 
5. Press the CTRL, SHIFT, and ESC keys at the same time to open Task Manager.
6. Click File, New Task (Run...).
7. Type cmd and press ENTER.
8. In the command prompt window type:
   
   copy %systemroot%\system32\dllcache\svchost.exe %systemroot%\system32\
   
   
9. Press ENTER. 
10. After the copy is completed, restart the computer.
11. After the computer restarts, right-click the M icon and manually check for an update to get the new DAT files.

If you are still unable to restore your system using the steps above, run System File Checker:

1. Press the CTRL, SHIFT, and ESC keys at the same time to open Task Manager.
2. Click File, New Task (Run...).
3. Type sfc /scannow, and click OK.

System File Checker will scan the system and attempt to repair the missing file. If System File Checker is unable to locate a replacement file, it may prompt  you to insert your Windows XP disk. Insert the disk to complete the repair process.

Getting Phone Support
If you are uncomfortable running these steps, or would prefer assistance, McAfee is offering free support to resolve this issue. Call our US support lines at (866) 622-3911 and select Option 1.  For local numbers in other countries, use TS100975 Customer Service Contact Numbers.

Message was edited by: Somer Pyron on 4/25/10 12:46:59 PM CDT

[Ehapi]

Hi,

Not knowing anything about the update or DAT file, only that around noon today, I received a message to the effect of: NT Authority/System... DCom Server Process Launcher etc. followed by a countdown to shut down and restart etc. MSC was dead and I was able to run WIN MaL Sware Rmover which found nothing it says. I then ran McAfee FreeScan from the web site which also found nothing.

Would the fix you guys are working on be my solution as well? I do not know what ver DAT I presently have since MSC is not opening.

[Peacekeeper]

Till Somer posts back this is the way to restore Svhost and get XP PCs back up

Restoring SVCHOST.EXE on customers affected  by DAT 5958
Please follow these steps exactly as directed or you may  not be able to disable VirusScan.

1. Start the customer’s computer in Safe  Mode. (When starting press F8 and pick Safe Mode)
2. Open My  Computer
3. Double Click C:
4. Double Click Program Files
5.  Double Click McAfee
6. Double Click VirusScan
7. Delete the DAT  folder
8. Press Click Start>Run Type cmd and Click OK
9. In the  command prompt window type CD\
10 Now type dir svchost.exe /s /b
11.  The command will return the location of svchost files.
12.  C:\Windows\ServicePackFiles\i386\svchost.exe is very common on XP so  hopefully you find it there.
13. Once you find it copy it from that  location to C:\Windows\system32
14. For example copy  C:\Windows\ServicePackFiles\i386\svchost.exe c:\windows\system32
15.  Once the file is copied reboot

[jerryc6]

I could not follow any of the steps above. when going into VirusScan there is no DAT file. lots of RES files but no DAT file. also when looking for the SVChost. it returns with no file. windows does not let me copy and past the SVChost from my flash drive to system32. Is there anything left i can try to get this working? anything? even when i bring up the VirusScan Console...its empty!

[Former Member]

Hey Jerry, I'm not sure how far you got in the document. I think you'll have to copy the svchost somewhere other than system32, then copy it to system32.

[kronen]

hi.

i turned my pc on at 9:40 this morning.  it is now 4:52pm as i begin to write what will, and i'm not remotely sorry to say, turn into a bit of a rant.

i've tried both the solutions offered on your help pages for home users.  neither works.  i'm lucky firefox can even get online, since none of my other web-based apps can.  i'd put links to these solutions on here, but wait, i can't, you've broken my computer and i can't copy and paste.

so far today i have:

turned my computer on.

had no windows/task bar

been unable to sign in on msn

been unable to run ultima online, world of warcraft etc

got rather frustrated

checked wtf is going on, and got pretty poor information from your website.

the solution we are directed to tells us to DOUBLE CLICK SOMETHING IN THE SYSTEM TRAY THAT WE CAN'T ACCESS BECAUSE YOU BROKE OUR COMPUTERS.  brilliant first step, that.  i downloaded that sdat5958_em thing, it gives me error messages when i run it.  this is probably because i first followed the instructions in the link on the page from which you download this file, and deleted the DAT folder first.  so none of that works, no not at all.

fine, moving on, let's try replacing svchost.  oh, wait, i can't do that either, i can't copy and paste it from my removable media (ipod) to my fubar computer.  i've tried right click, select copy, right click, select paste; i've tried ctrl+c, ctrl+v; i've tried using cmd commands to copy things.  nothing works.  i've zipped svchost on my ipod (taken from my laptop which, thank god, doesn't have mcshitty on it), then unzipped it and selected system32 folder as the extraction destination.  rebooted.  STILL NO TASK BAR.

oh and ofc i can't do a system restore because you've broken that too.

i really can't stand to go into any more details of how many different things i've tried to fix this.  i've attached a text file that was created when i first ran the thing i downloaded from your site to try and fix it (superdat.log)

can i have some clear, working instructions on how to fix this?  and how about some compensation?  i'm on a week off work and today was set aside for some important computery tasks, and i've wasted 8 hours of my day so far because of you.  how about a free 12 month subscription to norton antivirus?

Message was edited by: kronen on 4/22/10 11:10:08 AM CDT

[Former Member]

Hi kronen,

   From what you've told me, there are honestly many reasons this could have failed. For one thing, I don't know that the iPod drivers would load in safe mode. Additionally, the account you used to login might have restricted rights.

   Try putting the file on a cd-rom if possible, reboot to Safe Mode (and use an administrator account). Try running the sdat5958_em.exe from the command prompt, then delete the dat file and restart. I'll put these steps below so you have them formally typed out:

1. From a working computer, download http://download.nai.com/products/mcafee-avert/tools/SDAT5958_EM.exe and save it to a removable media (eg: Thumb Drive, CDROM).
2. Start the affected computer in Safe Mode (When booting, press F8 and choose Safe Mode).
3. Copy the SDAT5958_EM.EXE file to your desktop.
4. Run the SDAT5958_EM.EXE tool.
5. Open My Computer and navigate to C:\Program Files\McAfee\VirusScan.
6. Delete the DAT folder.
7. Restart the computer normally.
8. After the computer restarts, right-click the M icon and manually check for an update to get the new DAT files.

If this still doesn't work for you, we need to get you in touch with a support agent so we can create a ticket and escalate this if needed. Please let me know, I'll do whatever I can to help you out!

[kronen]

how do i copy it to my desktop when it doesn't work via command prompt, keyboard shortcuts or mouse clicks?

[Astounded]

Kronen,

Had exact same problem. I copied from the command prompt, from a portable drive, to the desktop. I apologise if I'm pointing out the obvious, but did you put speech marks around the path.

e.g. C:\Documents and Settings\Kronen\Desktop> copy where_the_file_is_stored_and_it's_name_and_extension

after doing this boot in safe mode, this is best done in msconfig and change the boot.ini

now run the macafee program

change boot.ini back to normal

reboot

re-install network connections

and hopefully Bob's your cross-dressed auntie.

Good luck

[Astounded]

Kronen,

just read your dat log and it looks like Mcafee was running - safe mode should stop this - there should be no icon on the systray

Somer - you should have spotted that and helped him out!!!!!!