Wednesday, 21 April 2010

Fixing McAfee W32.wecorl.a false alerts

The issues with McAfee are caused by it incorrectly detecting the Trojan W32/wecorl.a.
When it detects it, McAfee then deletes the svchost.exe file, resulting in many services being unable to run.. especially the network service
The following instructions will help you to fix your PC.


Please copy the this file to a USB disk.

It is a file from McAfee which cancels out the detection of the W32.wecorl.a false alerts.

Log on to your PC.

Windows Key + R
        cmd

In the black box, type:
        net stop mcshield

You might need to enter this a few times until you get a message saying the service has been stopped.


This should stop your PC from restarting before you can complete the following procedures.


Plug in the USB drive. In this example we will assume that the USB drive is recognised as drive E:, but you will have to substitute your drive letter.

Type:
           copy E:\extra.dat "c:\Program Files\Common Files\McAfee\Engine"
           net start mcshield

Then right click on the VirusScan icon and select VirusScan Console and open up Quarantine Manager Policy





Click on the Manager Tab, highlight any files which have the detection type of W32.wecorl.a right click them and select “Restore”

You may receive some error messages, but you should be able ignore it. Reboot, and your PC should be restored.

Hopefully this will help you out of a sticky situation, feel free to click on an advert on the page to show your appreciation.