Thursday, April 22, 2010

How to Fix Mcafee 5958 update Error

How to Fix Mcafee 5958 Error – A lot of McAfee users are having this trouble on an McAfee 5958 Error.

These steps are taken from McAfree Technical Support:

Workaround 1

McAfee has developed an EXTRA.DAT to suppress this detection. The file is attached to this article. This EXTRA.DAT does not fix the issue, it only suppresses the detection.

Apply the EXTRA.DAT to all potentially affected systems as soon as possible.

For systems that have already encountered this issue, start the computer in Safe Mode and apply the EXTRA.DAT. After applying the EXTRA.DAT, restore the affected files from Quarantine.

To apply the EXTRA.DAT locally:

IMPORTANT: For VirusScan Enterprise 8.5i and later, an Access Protection feature must be temporarily disabled before proceeding. For instructions on how to temporarily disable Access Protection in the VirusScan Console.

To apply the EXTRA.DAT locally:

1. Download the EXTRA.ZIP file attached to this article and extract the EXTRA.DAT file.

2. Click Start, Run, type services.msc and click OK.

3. Right-click the McAfee McShield service and select Stop.

4. Copy the EXTRA.DAT file to the following location:

\Program Files\Common Files\McAfee\Engine

5. In the Services window, right-click McAfee McShield and select Start.

For instructions on how to deploy the EXTRA.DAT through ePolicy Orchestrator (ePO), see:

* ePO 4.0 – KB52977 on https://kc.mcafee.com/corporate/index?page=content&id=KB52977

* ePO 4.5 – KB67602 on https://kc.mcafee.com/corporate/index?page=content&id=KB67602

To restore files from Quarantine locally:

1. Open the VirusScan Console.

2. Double-click Quarantine Manager Policy.

3. Click the Manager tab.

4. Right-click the required item and select Restore.

For additional information, see the VirusScan Enterprise Product Guide for your version of VirusScan Enterprise.

For instructions on how to use an ePolicy Orchestrator Scheduled task to restore quarantined files, see the ePolicy Orchstrator Product Guide.

Workaround 2

If the false detection has deleted or quarantined svchost.exe on your system:

IMPORTANT: Ensure that you have applied the EXTRA.DAT to suppress the false positive detection before restoring svchost.exe.

Copy the svchost.exe from a working system

1. On a computer that is not affected by the issue, navigate to the location below:

C:\WINDOWS\system32

2. Copy svchost.exe to a network location or removable media device.

3. On the affected system, copy svchost.exe to the location below:

C:\WINDOWS\system32

4. Restart the affected computer.