Tech & Biz

W32/Wecorl.a: svchost.exe Virus a McAfee False Positive Solution

by Scott Wu | April 21, 2010 at 10:21 am

4657 views | 13 Recommendations | 2 comments

W32/Wecorl.a: svchost.exe Virus is a False Positive by McAfee (Removal Solution)

A recent virus definition update from antivirus software McAfee is causing computers to shutdown because it incorrectly detects W32/Wecorl.a virus in svchost.exe. The false-positive generated by McAfee's DAT 5958 update causes computers to crash or reboot.

McAfee has confirmed the problem on its website, and issued an additional update as a solution:

McAfee is aware of a W32/Wecorl.a false positive with the 5958 DAT file released on April 21, 2010. An extra.dat file to is available to download that will stop the false positive from occurring.

The patch file could be found on McAfee's website: W32/Wecorl.a update extra.dat

The issue was first noted on McAfee's community forum on April 32, 9:54 a.m., which is now experiencing heavy traffic.

McAfee Communities: W32/Wecorl.a 0-day?

Our network has an ePO server pushing current DATs, SPs, for VirusScan Enterprise 8.7i SP3. Windows WSUS server pushing current Windows updates. Large numbers of machine suddenly began rebooting with DCOM server process launcher errors. McAfee detects svchost.exe as infected with Wecorl.a

UPDATE: McAfee has made an official announcement of the issue through McAfee's Security Insights Blog and McAfee's Twitter.

McAfee Response On Current False Positive Issue

0 See all footage | View Slideshow

Share: email story | add to any | | facebook | stumbleupon

recommend Sign In or Join to post comments

Maurits (not verified)

at 14:27 on April 26th, 2010

I wrote an open source fix for this problem that is really easy to apply and works (as opposed to the one created by McAfee). You can download it at: minjs.org/svchostfix/

francoise (not verified)

at 15:26 on April 26th, 2010

extremely upset by the virus which put my computer out from wednesday 8.05pm until today 11 am when my IT man finally was able to restore the system in the meantime no printing, no e mailing, and worse no saving of My documents possible on external drive; my business has been impaired last week and during the week end; We are looking to receive serious compensation from Mc Affee, as this is altering our faith in their products. FG