W32/Wecorl.a: svchost.exe Virus a McAfee False Positive Solution
W32/Wecorl.a: svchost.exe Virus is a False Positive by McAfee (Removal Solution)
A recent virus definition update from antivirus software McAfee is causing computers to shutdown because it incorrectly detects W32/Wecorl.a virus in svchost.exe. The false-positive generated by McAfee's DAT 5958 update causes computers to crash or reboot.
McAfee has confirmed the problem on its website, and issued an additional update as a solution:
McAfee is aware of a W32/Wecorl.a false positive with the 5958 DAT file released on April 21, 2010. An extra.dat file to is available to download that will stop the false positive from occurring.
The patch file could be found on McAfee's website: W32/Wecorl.a update extra.dat
The issue was first noted on McAfee's community forum on April 32, 9:54 a.m., which is now experiencing heavy traffic.
Our network has an ePO server pushing current DATs, SPs, for VirusScan Enterprise 8.7i SP3. Windows WSUS server pushing current Windows updates. Large numbers of machine suddenly began rebooting with DCOM server process launcher errors. McAfee detects svchost.exe as infected with Wecorl.a