CITES | University of Illinois

Faulty Antivirus DAT

Earlier today, our campus antivirus vendor, McAfee, released an antivirus signature definition file (known as a "DAT") which contained a bug.

Earlier today, our campus antivirus vendor, McAfee, released an antivirus signature definition file (known as a "DAT") which contained a bug. This bug caused a number of computers running Windows XP to appear to be infected with a computer virus and generally interfere with the operation of the computer. This problem is not limited to our campus but is impacting McAfee customers nationally.

Computers affected by the buggy DAT may reboot frequently or report the virus W32/Wecorl.a was found.

If you are experiencing any of these symptoms you are probably seeing the impact of this buggy DAT. McAfee has released a new and corrected DAT and the buggy DAT has been replaced in the campus DAT repositories by CITES Security. Many machines will automatically update and repair themselves. Others may require manual intervention.

We strongly encourage you to talk to the IT professional staff in your unit for assistance in repairing computers that are not repairing themselves. For those of you without IT support (or on your home machines) McAfee has posted work-arounds on their web site at: http://vil.nai.com/vil/5958_false.htm. Please note that these instructions are not for the faint at heart but were created for IT professionals. The CITES Help Desk is also available for those without local support: http://www.cites.illinois.edu/help/ or 244-7000.

Once we have completed a fuller recovery guide, it will be linked off of the CITES Home page, http://www.cites.illinois.edu. This problem has been widely reported in the press, some of which is linked below: Press Coverage: http://www.nytimes.com/aponline/2010/04/21/business/AP-US-TEC-McAfee-Antivirus-Flaw.html
http://www.computerworld.com/s/article/9175896/Flawed_McAfee_update_paralyzes_corporate_PCs?taxonomyId=125
http://www.google.com/finance?client=ob&q=NYSE:MFE

Last updated Sunday, March 4, 2012, 11:59 pm