Unable to use Windows after updating the DAT file

[Wobblyhead]

OK, so i've got the following:

C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

C:\WINDOWS\ServicePackFiles\i386\svchost.exe

C:\WINDOWS\system32\svchost.exe

(plus a version associated with a BartPE build)

(the version in system32 is showing as 5.1.2600.5512)

Message was edited by: Wobblyhead on 29/04/10 15:49:47 CDT

[synchroman]

This has been reported as being a False Positive. The interpretation to me is that it thinks that something was infected, in this case the “svchost.exe” and deleted it. This is what I was getting on the blogs.

First of all when I received the computer for repair I was not able to use the mouse or keyboard.  After reading the blogs about the “svchost.exe” file being missing I went to the C: drive via an external Linux program.  Replaced the missing “svchost.exe” file into C:\Windows\System32 and into C:\Windows\System32\dllcahce, even thou non of my WinXP computers have this file in such a folder.

Rebooted the computer into native WinXP Pro and I now had mouse and keyboard control but within about three minutes a “System Shutdown” message popped up.  I stopped the shutdown with the following command, “shutdown –a”.  All well and good to a point and that point being that very few commands will work. Functions like copy, install, networking devices, computer management services, install and many others did not function.

Discovered that even thou I was able to get into windows the “svchost.exe” file was gone out of C:\Windows\System32.

To make a long story short, I discovered that the McAfee dat files were the virus.  It was the dat files that were deleting the “svchost.exe” file.  I would consider this the virus and not a false positive.

Deleted the dat file while in safe mode but was not able copy “svchost.exe” even from the cmd window.

Rebooted back into the Linux remote and copied the “svchost.exe” into C:\Windows\System32.  Rebooted back into WinXP pro with normal results and no “System Shutdown” message.

My conclusion is:

The McAfee dat folder needs be deleted first then replenish the deleted “svchost.exe” from outside of the Windows operating system.  This could be done with the Repair Console.  I very ware use such anymore now that I have the remote Linux boot option.

Hope this have at least helped one person.

TWS

HAPPY PC COMPUTING

[karladam]

My svchost.exe I uploaded from an office pc and it ended up in C:WINDOWS/I386 on my machine which the second updated McAfee Supertool was able to detect. Cannot describe the relief after days of trying to deal with a non-responsive pc, especially since the McAfee staff has been singularly uninterested in even responding to messages. Tech staff here in Holland were completely overwhelmed by requests for help and little coordination was available from the US for the first week. Started a threat with a simple question here a couple of hours ago and no response either. I feel so let down by the support by McAfee and feel sickened watching the late response video by the CEO which has finally appeared on the site. With no network access and no tech support available, I've really started questioning what business these companies who promise protection really are in.

[cosmo1]

Somer, I am now practically convinced that my machine is running properly again. No thanks to McAfee Netherlands who after queries on my part sent me a confirmation 492674110 on the 23rd and from whom I have heard not one word since. You seem to be doing the impossible but here they're just sitting on their hand I suppose. But what can onze expect with office hourse Mon-Fri 9AM-6PM and no tollfree numbers where you wait and wait and wait.Seems the word service doesn't exist in their vocabulary.

People tell me to get rid of McAfee and switch to free Microsoft security Essentials. Is that the definitive solution?

[karladam]

Cosmo 1, good to hear I'm not the only one spending a week of my time trying to reach the Dutch helpdesk. Finally managed to speak to a real person the day before yesterday but after one minute he "needed to consult a colleague" and the line went dead. Not much luck in getting a response from this site either, seems they are only interested in the US customers.

[ICEE]

Add me to the list.

Running XP SP3, Windows and McAfee all up to date, etc. System uses Mirrored Raid setup.

System is running fine, then ...bang! ...  DCOM blue screen. From there, nothing worked the way it should and it looked like a nasty trojan or rootkit had taken over (little did I know).

I didn't find out about the bad DAT file until days later while using a different computer. At that point I was already deep into testing and it's hard to tell how much more damage was done due to all of the BSODs I had.

I won't go into all of the details since everyone has already mentioned them, but let's just say that I took every step I could to find the "problem" and fix my system:

- tested RAM (Dell sent me replacement RAM (4GB) and a video card to try because of how screwed up everything was and nothing could be nailed down as a cause)

- ran every possible rootkit scanner / online scanner / utility I could (both safe and normal modes) - no errors found.

- ran Dell's diagnostics for 2-1/2 days solid - no errors found

- as a last resort, pulled one of my raid drives, put it in a USB enclosure and ran every test possible from another computer - no problems found on the drive and nothing changed.

- transferred documents from system drive to an external drive; scanned that drive with every utility I have - no problems found.

- put system drive back in, booted ... crash

- booted from second system drive ... crash

- did system restore from Dell's partition

Maybe I'm just one of the "lucky" ones to have had as many problems as I did, but I can say that it has been one of the longest, most stressful weeks I've had in a long time. I can't even imagine what someone would have charged me to do everything I tried.

My subscription runs out in about 10 days. Maybe that's a good thing.

[Former Member]

Karladam,

   I'm unhappy to hear you had such a bad experience with McAfee support in Holland. I will report this to our Customer Service. I will be sending you a private message momentarily to get your contact information.

Thank you for bringing this to our attention, and I'm glad that you're up and running now!

[Former Member]

Hi cosmo1,

   Thank you also for letting us know what happened when you contacted support. I'll be sending you a message just like karladam, to try and get more information and make sure your experience is reported to a manager. Regarding your last question, I still think our product is the best.

[cosmo1]

Somer, thanks for your reaction. I have finally received a first reply today, a week after my initial query to McAfee NL !!! And that is just a "press the button reply" more or less identical to the first instructions on your (US) site. I'm glad I wa able to work out how to get things going from your site and your postings which were most helpful. I sent them a reply and told tem to have a look at what is happening on this forum-site.

As to your opinion that McAfee is the best, one thing seems pretty sure: the chance of such a disaster occuring again looks extremely slim

Message was edited by: cosmo1 on 4/30/10 10:11:37 AM CDT

[Wobblyhead]

Any help with my issue would be helpful...