A malware definitions update pushed by antivirus giant McAfee to its customers yesterday contained a buggy detection routine that caused millions of
computers to go into a reboot loop. The severe system instability issue resulted from erroneous blocking of the critical svchost.exe file on computers running Windows XP SP3.
The problematic update, identified as the 5958 DAT, detected the svchost.exe file on Win XP SP3 systems as being infected with new variants in the Wecorl family of malware. According to Microsoft, svchost.exe is a vital Windows system file in charge of loading services that run from DLLs.
McAfee released a corrected update, DAT 5959, hours after the bogus definition went out. However, the fix has to be deployed to affected systems manually in Safe Mode, a nightmare for IT staff in large enterprises with thousands of computers. Additionally, if the svchost.exe file has been deleted or quarantined, it must be restored from backup locations. The procedure is
described in more detail in a McAfee knowledge base article associated with this incident.
