BreadcrumbsHome / McAfee Restarts/Reboots/Shutdowns Windows XP FIX
McAfee Restarts/Reboots/Shutdowns Windows XP FIX
Last Updated on Thursday, 22 April 2010 08:53 Written by Naota Friday, 23 April 2010 12:00
Here is a solution on how to fix the latest McAfee incident. The latest update causes Windows XP user’s computers to shutdown, or reboot. The following steps are courtesy of CNET.
Note: We recommend using a different Antivirus such as Kaspersky, Avira, or Nod32.
# Step 1: Open a command prompt: Start menu, Run, then type cmd and hit Enter Step 2: Type shutdown -a, which will prevent the shutdown from occurring McAfee has revealed two fixes for the problem. Each one requires multiple steps, and can be confusing. If you’re not comfortable with advanced computer fixes, you should get help with this.
For the first fix, go to the McAfee interface through the Start menu, and disable Access Protection and On-Access Scanner.
# Step 1: Click Start, Programs, McAfee, and then VirusScan Console
# Step 2: Right-click “Access Protection”
# Step 3: Select “Disable” If you have Internet access, download the EXTRA.ZIP file provided by McAfee and unzip the EXTRA.DAT within. (Note that Nai.com is a safe site maintained by McAfee, for those who were wondering.) Once EXTRA.DAT has been extracted:
# Step 1: Click Start, Run, then type services.msc and click “OK”
# Step 2: Right-click the McAfee McShield service and select “Stop”
# Step 3: Copy EXTRA.DAT to “\Program Files\Common Files\McAfee\Engine”
# Step 4: Then restart the McAfee McShield service by right-clicking on it and choosing “Start” from the context menu
# Step 5: Re-enable access protection by going back to the VirusScan Console
# Step 6: Right-click “Access Protection”
# Step 7: Select “Enable”
# Step 8: In the VirusScan Console, go to the Quarantine Manager Policy
# Step 9: Click the Manager tab
# Step 10: Right-click on each file in the Quarantine and choose “Restore” There is, of course, one massive hang-up with this McAfee-recommended solution: More likely than not, you don’t have Internet access on your McAfee-borked computer. In fact, it’s highly unlikely that you have access to much of anything, since deleting SVCHOST.EXE prevents key Windows 32-bit sub-system processes from functioning at all. To get the EXTRA.DAT on your computer, you’ll probably have to download it on an unaffected computer, then copy it to either a USB drive or a CD-ROM and use the command prompt to copy it over to your C: drive.
The second workaround requires that you apply the EXTRA.DAT fix as detailed above before beginning and that you have access to a second, unaffected Windows XP computer. On that computer, go to C:\WINDOWS\system32 and copy SVCHOST.EXE to a network location or a removable media device such as a USB stick. Then copy the SVCHOST.EXE from the unaffected computer to the affected computer, and restart the McAfee-afflicted computer. There are details on applying the EXTRA.DAT via ePolicy Orchestrator at McAfee’s fix on Nai.com.
Severe problems caused by buggy or false positive security updates are rare, but not unheard of. Recent instances include an update from Avast that marked hundreds of legitimate files as threats in December 2009, Computer Associates flagging a Windows system file as a virus in July 2009, and AVG marking ZoneAlarm as malware in October 2008.