Knowledge Partner
Knowledge Partner

Re: Mcafee Enterprise users, warning...

grimlock;1965020 wrote:
On 4/21/2010 10:56 AM, thsundel wrote:

> Yep got many answers, time to get my as* off the sofa and back to
> work.
>
> Many thanks for the heads up grimlock!
>
> Thomas


We notice that you've been holding for a few minutes (56 now).

I wish I could change my http forum name from Grimlock to my actual
name.. Sigh.

Patrick


Back again. For safety, I disabled the pull on both of our ePO environments.

Thomas
0 Likes
Highlighted
grimlock1 Absent Member.
Absent Member.

Re: Mcafee Enterprise users, warning...

On 4/21/2010 9:53 AM, Patrick Farrell wrote:
> The April 21st dat updates (5958.0000) (VirusScan 8.7i)are nuking all of
> my systems by detecting a false positive in svchost and causing a system
> shutdown. Lovely. Most people can barely get logged in before it starts
> shutting down, so naturally they can't read any e-mail I want to send
> them about how to work around this.
>
> This is going to be a fan-freaking-tastic day...



They are e-mailing me an extra.dat file.

1 hour and 37 minutes on hold.
0 Likes
hspeirs Absent Member.
Absent Member.

Re: Mcafee Enterprise users, warning...

Patrick,

> Where did you find that info? The McAfee rep that's in the discussion in
> the forums hasn't posted any update info yet on the issue 😞


One of my colleagues sent it out. Have sent you a copy.

H.
0 Likes
grimlock1 Absent Member.
Absent Member.

Re: Mcafee Enterprise users, warning...

On 4/21/2010 11:56 AM, thsundel wrote:
>
> grimlock;1965020 Wrote:
>> On 4/21/2010 10:56 AM, thsundel wrote:
>>
>>> Yep got many answers, time to get my as* off the sofa and back to
>>> work.
>>>
>>> Many thanks for the heads up grimlock!
>>>
>>> Thomas

>>
>> We notice that you've been holding for a few minutes (56 now).
>>
>> I wish I could change my http forum name from Grimlock to my actual
>> name.. Sigh.
>>
>> Patrick

>
> Back again. For safety, I disabled the pull on both of our ePO
> environments.
>
> Thomas
>
>


I attached the fixed extra.dat in the thread in mcafee forums.

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Mcafee Enterprise users, warning...

But what about the busted PCs?

Do you need to Do some type of Safemode boot?
Can you copy the file over via a SystemShare before a user logs in?

What a mess!

On 4/21/2010 12:53 PM, Patrick Farrell wrote:
> On 4/21/2010 9:53 AM, Patrick Farrell wrote:
>> The April 21st dat updates (5958.0000) (VirusScan 8.7i)are nuking all of
>> my systems by detecting a false positive in svchost and causing a system
>> shutdown. Lovely. Most people can barely get logged in before it starts
>> shutting down, so naturally they can't read any e-mail I want to send
>> them about how to work around this.
>>
>> This is going to be a fan-freaking-tastic day...

>
>
> They are e-mailing me an extra.dat file.
>
> 1 hour and 37 minutes on hold.



--
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner

Novell does not officially monitor these forums.

Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.
--
Please give a hearty thumbs up to any post you find helpful!
To find articles by Craig Wilson simply follow the link: Craig Wilson's Tips!
0 Likes
grimlock1 Absent Member.
Absent Member.

Re: Mcafee Enterprise users, warning...

On 4/21/2010 12:01 PM, craig wilson wrote:
> But what about the busted PCs?
>
> Do you need to Do some type of Safemode boot?
> Can you copy the file over via a SystemShare before a user logs in?
>


Well that's the issue. The system is going to reboot regardless of if
the user logs in or not. I have a borked one on my bench that I've left
broken for testing.

http://community.mcafee.com/message/125584#125584

That thread was posted for automated rollback.

If you can get the extra.dat file into c:\program files\common
files\mcafee\engine then you are good.

You can log in, copy it in, use zen file transfer, copy via share,
whatever it takes. You may have to log it in, and issue a shutdown /a.

You may also need to do this via safe mode to apply the file.. hard to say.


0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Mcafee Enterprise users, warning...

I've actually gone through and called those people who show "unread" on my
emails and ask "Is there any reason you decided to not read my email?"

Luckily, I scare them enough that it works. 🙂


"Patrick Farrell" <pfarrell@packereng.com> wrote in message
news:JaFzn.22137$yE3.7340@kovat.provo.novell.com...
> On 4/21/2010 10:48 AM, Joseph Marton wrote:
>> On Wed, 21 Apr 2010 14:53:03 +0000, Patrick Farrell wrote:
>>
>>> Most people can barely get logged in before it
>>> starts shutting down, so naturally they can't read any e-mail I want to
>>> send them about how to work around this.

>>
>> They won't be able to read your e-mails about the problem? How is this
>> different from a normal day? Don't tell me your users actually normally
>> read e-mails you send out!
>>

>
> True.. I always set my e-mails to show all status, and I frequently see
> "deleted" but not opened. Naturally those are the ones that call with
> questions regarding what was in the e-mail.
>
> Even if they read it, they usually read about one paragraph and then call
> and ask me something that was farther down. I'll ask "Did you read my
> e-mail?" Well part of it, but I decided to call instead.
>
> Sigh.
>



0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Mcafee Enterprise users, warning...

On Wed, 2010-04-21 at 14:53 +0000, Patrick Farrell wrote:
> The April 21st dat updates (5958.0000) (VirusScan 8.7i)are nuking all of
> my systems by detecting a false positive in svchost and causing a system
> shutdown. Lovely. Most people can barely get logged in before it
> starts shutting down, so naturally they can't read any e-mail I want to
> send them about how to work around this.
>
> This is going to be a fan-freaking-tastic day...


This attack from McAfee just took out a ton of our Win 98 boxes.

🙂 I'm glad I'm not the administrator of those.



0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Mcafee Enterprise users, warning...

craig_wilson;1965061 wrote:
But what about the busted PCs?

Do you need to Do some type of Safemode boot?
Can you copy the file over via a SystemShare before a user logs in?

What a mess!

On 4/21/2010 12:53 PM, Patrick Farrell wrote:
> On 4/21/2010 9:53 AM, Patrick Farrell wrote:
>> The April 21st dat updates (5958.0000) (VirusScan 8.7i)are nuking all of
>> my systems by detecting a false positive in svchost and causing a system
>> shutdown. Lovely. Most people can barely get logged in before it starts
>> shutting down, so naturally they can't read any e-mail I want to send
>> them about how to work around this.
>>
>> This is going to be a fan-freaking-tastic day...

>
>
> They are e-mailing me an extra.dat file.
>
> 1 hour and 37 minutes on hold.



--
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner

Novell does not officially monitor these forums.

Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.


Where is that extra.dat file?
0 Likes
grimlock1 Absent Member.
Absent Member.

Re: Mcafee Enterprise users, warning...

On 4/21/2010 12:49 PM, Chris Cox wrote:
> On Wed, 2010-04-21 at 14:53 +0000, Patrick Farrell wrote:
>> The April 21st dat updates (5958.0000) (VirusScan 8.7i)are nuking all of
>> my systems by detecting a false positive in svchost and causing a system
>> shutdown. Lovely. Most people can barely get logged in before it
>> starts shutting down, so naturally they can't read any e-mail I want to
>> send them about how to work around this.
>>
>> This is going to be a fan-freaking-tastic day...

>
> This attack from McAfee just took out a ton of our Win 98 boxes.
>
> 🙂 I'm glad I'm not the administrator of those.
>


Their forums are down now from the traffic.


0 Likes
Knowledge Partner
Knowledge Partner

Re: Mcafee Enterprise users, warning...

abibbas;1965084 wrote:
Where is that extra.dat file?


https://kc.mcafee.com/corporate/index?page=content&id=KB68780

Thomas
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Mcafee Enterprise users, warning...

Are my DOS machines safe? I'm running MSAV.


"Chris Cox" <cjcox@no-mx.forums.novell.com> wrote in message
news:1271872183.18768.28.camel@geeko...
> On Wed, 2010-04-21 at 14:53 +0000, Patrick Farrell wrote:
>> The April 21st dat updates (5958.0000) (VirusScan 8.7i)are nuking all of
>> my systems by detecting a false positive in svchost and causing a system
>> shutdown. Lovely. Most people can barely get logged in before it
>> starts shutting down, so naturally they can't read any e-mail I want to
>> send them about how to work around this.
>>
>> This is going to be a fan-freaking-tastic day...

>
> This attack from McAfee just took out a ton of our Win 98 boxes.
>
> 🙂 I'm glad I'm not the administrator of those.
>
>
>



0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.