Ok, we need to do a search. From safe mode, inside the command prompt, type this:
dir svchost.exe /s /b
The search can take up to a few minutes to complete, depending on the number of files on your computer.
So once you find one (the C:\WINDOWS\$NtServicePackUninstall$\svchost.exe is a good example), you're going to copy it to system32. It'll look like this:
COPY c:\windows\DIRECTORY\svchost.exe %systemroot%\system32
(So to give you an example, COPY C:\WINDOWS\$NtServicePackUninstall$\svchost.exe %systemroot%\system32)
Give that a try and let me know please?
That is a bad example - you shouldn't recommend the use of the svchost.exe file from the C:\WINDOWS\$NtServicePackUninstall$ folder. This will just create more potential problem in the future. In short, by doing this you will create a mismatch of the versions. The $NtServicePackUninstall folder contains files that existed prior to the install of a Service Pack.
I had similar problems with not working task bar, network connectivity, etc. ... you name it ... all mentioned here. This was after removing the .dat and recovering the svchost.exe from dll....
The solution is in correct file ownership:
* If you recover svchost.exe while login through AD not as local user - you get the above mentioned issues
* This is because the system cannot use properly use svchost.exe until it can talk to AD, so it knows the user
* Solution is to be local admin user on the machine when restoring the file or to take local admin ownership
I hope someone from McAfee will pick this up and expand it properly for not so advanced users. Perhaps building it into the recovery tool would be fantastic.
I'm not fully out of the woods here as there are other little quirks, but they are trivial and most likely related to corporate networking setup/stagin.
I hope it helps, Tom
Thanks Tom, that's the same direction I was going with another user, so this is very helpful.
Yeah, the problem is though, if no other copy of svchost exists, and there isn't a windows CD, we have nothing to get her up and running enough to continue working. I'll look into this more. Thanks for the feedback!
Do I need to change the directory because when I type in the dir svchost.exe /s /b it says file not found but it is pulling from my documents and settings.
You indeed need to go to the root of the drive first.
Command you need to type for that is: cd\
Ack, thanks Mark! Sometimes the fingers go flying faster than my brain I guess.
Many thanks for replying and removing my email etc.
I don't know how many others in the UK or elsewhere, didn't see the connection between update DATs and the failure. I closed down for the night after the update and rebooted in the morning.
As I've said I took my machine to PCworld for repair, since I couldnt get into restore etc and like most others don't have an XP disc, didn't see anyway I could repair and didn't want to do a manufacturers reinstall.
But one lasting issue, that the technical staff had to deal with was the copy and paste. If this remains an issue for anyone, when the IE failed\internet etc, it unchecked in security the copy and paste option, which then for some reason caused problems throughout windows.
I backup, I keep a good antivirus, I update windows. But without a XP disc, risks were to high to have lost come of my recent files, photos of the grand children, from this month.
I was only able to track down information of the night and here when I could access on someone elses computer, which is where I am now.
So, we need to spare a thought for those out there who have no knowledge of what is now happening to their machine and the precious data they could have lost. PCworld, were about to reformat mine, although the techie was spending extra time to retrieve the one last important (not backed up) file, photo by photo, since there was no other way. What a guy . But we got there in the end and it's repaired - but, as I previously posted it cost £70, others are paying even more.
So let us look out for our friends. Regards to everyone and hope you all get sorted. I get my baby opppps computer back in the morning.
I'm Gabor from Hungary. Sorry my english language, but i'm now learning.
I'm repair my PC, see how:
1.: Copy USB (or any media) from the working PC the svchost file (My Computer, C: Program Files / WINDOWS / system32 / svchost).
2.: Start the tainted / bad computer in Safe Mode (When booting, press F8 and choose Safe Mode)
3.: Open My Computer and go to C: Program Files / McAfee / VirusScan
4.: Delete the DAT folder (only in Safe Mode is possible!)
5.: Create the new DAT folder (new folder is empty)
6.: Copy from USB (or any media) the svchost file into My Computer, C: WINDOWS / system32 (I used Total Commander for copy)
7.: Restart the computer in normally mode. After the restart, the system is working!!
8.: Open your McAfee program and click refresh.
9.: After the refresh check your DAT file (my new DAT file is 5961.0) : Open My Computer, C: Program Files / McAfee / VirusScan / DAT
Everything is all right, the PC is good.
I hope, help to everybody.
Good luck! 😉
I'm so very sorry you lost data! I'll glad the tech you worked with was so considerate!!
I hear what you're saying. I've been working (for about an hour now) on getting some simpler, easier to follow steps out just for my home users. We're also still testing some other repair options, so hopefully very soon we'll have this taken care of.
In the meantime, thank you for your post and the good information!
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership: