W32.Wecorl.a (or Variant) Infection across enterprise


W

wperry1

My company has just been hit with what seems to be a massive infection
of a new variant of the W32.wecorl.a virus. It has spread and infected
a large number of systems in our HQ office and for our remote users.

Users boot up and log in then they get a notice from McAfee that an
infection was detected and the system shuts down and reboots.

Systems are primarily WinXP with up-to-date patches and running McAfee
VirusScan Enterprise with updated Defs (at least to yesterday)

Is anyone else dealing with this? Any ideas on effective widespread
removal techniques?
 
Ad

Advertisements

Joined
Apr 21, 2010
Messages
8
Reaction score
0
Same problem

SOLVED:
https://kc.mcafee.com/corporate/index?page=content&id=KB68780

We removed the DAT file manually by booting the PC with a CD (Windows Recovery). Deleted files in c:\program files\common files\mcafee\engine with .DAT extension.
Download DAT from McAfee website: http://www.mcafee.com/apps/downloads/security_updates/dat.asp?region=uk&segment=enterprise
Install the downloaded DAT on the computer in normal Windows mode, and then reboot to apply the DAT.






We have the same problem, just a few minutes ago all our XP clients with McAfee shutdown with a message about DCOM service. Most of the network configs are broken and RPC service is stopped. We are trying to scan with the latest up-to-date anti-virus programs, but unable to delete this virus.

McAfee tells us it's wecorl.a, but that is an old virus. Can anyone help? All our XP computers are infected, in just a few minutes!
 
Last edited:
Joined
Apr 21, 2010
Messages
13
Reaction score
0
McAfee has confirmed that this is a false positive in today’s DAT, version 5958. At my orginization we are attempting to roll back the DATs to a previous version via ePO.
 
Joined
Apr 21, 2010
Messages
1
Reaction score
0
Confirmed, thet DAT file is the culprit. Get the DAT out of your repository and roll back to 5957.
 
Joined
Apr 21, 2010
Messages
1
Reaction score
0
Hi There,

We have the exact same probleme in the same type of envoronement XP + McAfee.
For the moment we are still trying to find a solution if you got anything let us know.

Regards,

Alex
 

hrc

Joined
Apr 21, 2010
Messages
1
Reaction score
0
Sam here, on hold w/McAfee. How do you roll back without using ePO?
 
Ad

Advertisements

Joined
Apr 21, 2010
Messages
2
Reaction score
0
Provide Link

If this is confirmed problem with the dat file - please post a link to McAfee's website.
 
Joined
Apr 21, 2010
Messages
13
Reaction score
0
mbaggett said:
If this is confirmed problem with the dat file - please post a link to McAfee's website.
Just confirmed via call w/McAfee. They will post info soon.
 
Joined
Apr 21, 2010
Messages
8
Reaction score
0
also on hold, but it takes a long time before i get a agent... even though we have gold support. It seems to be the DAT version, because we had no problems with the older DAT. When updating to the new DAT, everything crashed. We are rolling back atm with EPO.
 
Joined
Apr 21, 2010
Messages
13
Reaction score
0
hrc said:
Sam here, on hold w/McAfee. How do you roll back without using ePO?
If you experience problems with a recent DAT update in VirusScan, you can revert to the previous working update. To revert to the previous DAT version in VirusScan 8.x (also known as Rollback):
  1. Open the VirusScan Console by going to Start->Programs->McAfee->VirusScan Console.
  2. From the Tools menu, select Rollback DATs.
  3. When prompted whether you wish to Rollback the DATs, choose Yes.
The resulting window will display the rollback process. When completed, the window will display that it has updated successfully. You can click the Close button to close this update window. You may also close the VirusScan Console window.

Note: VirusScan will not allow you to apply the DAT file that you rolled back from again. VirusScan will not update itself until a newer version from the rollback DAT is available.
 
Joined
Apr 21, 2010
Messages
8
Reaction score
0
sconder said:
If you experience problems with a recent DAT update in VirusScan, you can revert to the previous working update. To revert to the previous DAT version in VirusScan 8.x (also known as Rollback):
  1. Open the VirusScan Console by going to Start->Programs->McAfee->VirusScan Console.
  2. From the Tools menu, select Rollback DATs.
  3. When prompted whether you wish to Rollback the DATs, choose Yes.
The resulting window will display the rollback process. When completed, the window will display that it has updated successfully. You can click the Close button to close this update window. You may also close the VirusScan Console window.

Note: VirusScan will not allow you to apply the DAT file that you rolled back from again. VirusScan will not update itself until a newer version from the rollback DAT is available.
Not working because the service is down and cannot be started... trying safe mode now
 
Ad

Advertisements

Joined
Apr 21, 2010
Messages
1
Reaction score
0
Hi guys,
same for us...
I'm on safe mode but I cannot see the Rollback DATs menu under tools... any idea?
 
Joined
Apr 21, 2010
Messages
1
Reaction score
0
My company is getting massive amounts of reboots due to Windows process (DCOM, RPC) errors. This doesn't sound like a false positive. Could the DAT be causing the reboots? Please advise!
 
Ad

Advertisements

Joined
Apr 21, 2010
Messages
13
Reaction score
0
radi0head44 said:
My company is getting massive amounts of reboots due to Windows process (DCOM, RPC) errors. This doesn't sound like a false positive. Could the DAT be causing the reboots? Please advise!
Yes. Since it detects SVCHost.exe as being infected, it attemptes to take action on the file thus prompting a reboot.
 
Joined
Apr 21, 2010
Messages
1
Reaction score
0
Does anyone have a link to some hard evidence that the dat is bad? I am also receiving the same symptoms, but I need something before I start rolling back 5000 pcs?


Thanks!
 
Joined
Apr 21, 2010
Messages
8
Reaction score
0
1 computer was hard to downgrade in DAT file. We had to boot from CD, remove .DAT files in C:\program files\common files\mcafee\engine and then reboot. At reboot we installed the DAT from McAfee website with /f parameter, rebooted and it works now.
 
Ad

Advertisements

Joined
Apr 21, 2010
Messages
2
Reaction score
0
You can force the dat file to install even if the version is older than the existing one:

5957xdate.exe /f

The bad dat is no longer in the repository so that should fix the program.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Probably a [email protected] Infection? 1
Help! New Variant Of WinSerflog or W32/Sumom-C 18
Infections 1
W32.SPYBOT.WORM 5
W32.WELCHIA.WORM 4
BO2K.Trojan Variant 2
New variant? 4
W32.Surflog.B 0

Top