McAfee have posted help on how to resolve issues on computers that have been affected by the DAT5958 problem that has caused problems world-wide on 21st April 2010.

The McAfee KnowledgeBase article is at:-

https://kc.mcafee.com/corporate/index?page=content&id=KB68780

DAT5959 is now available from McAfee.

More information about the issues are on this blog.

Readers may also be interested in our Managing Consultant's take on this incident, which will be syndicated to IT Director tomorrow.

As an update to our earlier posts:-

McAfee DAT 5959
Major Issues with McAfee AntiVirus DAT5958
McAfee VirusScan Enterprise with DAT 5958 on Windows XP SP3 Machines

McAfee have now released DAT5959 to their web site at http://www.mcafee.com/apps/downloads/security_updates/dat.asp.

We advise caution in apply this update, suggesting that it  should be trialled first on test machines before generally being rolled out.

We understand that McAfee has released DAT5959, which is identical to DAT 5958 that is causing machines world-wide to crash, except is does not contain the "problem".

We believe this DAT was released at 10:15 PDT (GMT-7), although is does not appear to have been posted to the McAfee/NAI web sites as at the time of this post. We presume that this is initially being rolled out to the McAfee update network.

Further to our earlier advisory this afternoon, we now understand that McAfee have suspended DAT 5958 from their update network.

In a circular email, McAfee have stated:-

The 5958 DAT has been removed from McAfee download servers, preventing any further impact to corporate customers. McAfee teams are working with the highest priority to support impacted customers and plan to provide an update virus definition file shortly.

McAfee have provided more details on their web site and on the McAfee Community Web Site. These sites are currently running slowly because of the huge demands being placed on them at present.

Anecdotal reports being picked up by us show huge number of sites being affected world-wide, some with thousands of machines being affected.

Our current understanding is that this only affects Windows XP SP3 machines.

We are receiving reports that McAfee's AntiVirus DAT5958 is causing Windows XP SP3 machines to fail.

Early indications are that this latest update detects svchost.exe as Win32/wecorl.a causing affected machines to crash.

We are aware of whole sites being taken down. Our advice is not to update to DAT5958 and to switch off the autoupdate feature in McAfee VirusScan Enterprise.