McAfee False Detection Update Quarantines svchost.exe

April 22, 2010 | Filed under Security


Antivirus are meant to protect a computer against virus but it can cause worldwide computer problems if they released an update with a false detection on a critical Windows system file. Every once in a while an antivirus will make a mistake by flagging a legitimate windows system file as a threat and automatically quarantines the file and subsequently causing the Windows unbootable. AVG, Kaspersky and Norton has done it before and the latest one is McAfee.

The file C:WINDOWS\system32\svchost.exe contains the W32/Wecorl.a Virus.
Undetermined clean error, OAS denied access and continued.
Detected using Scan engine version 5400.1158 DAT version 5958.0000.

McAfee seems to detect svchost.exe, one of the critical Windows system file as a Wecorl virus. If you allow McAfee to quarantine the file, you will end up with a reboot loop where Windows automatically shuts down everytime windows is booted up. Fortunately only one specific version of Windows is affected which is Windows XP with Service Pack 3.

McAfee has posted an article on more information about this false positive and method to fix your computer. You can refer to this link

In short, you will need to boot in to Safe Mode with Networking, download and copy the extra.dat file to c:\program files\commonfiles\mcafee\engine, copy svchost.exe to C:\windows\system32\ and your computer will now work fine.

Speak Your Mind

Tell us what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!