McAfee deleted svchost.exe

Wednesday afternoon I had at least two reports of workstations that were suddenly rebooting on their own. No networking and no taskbar were also symptoms. I thought it may be a virus, so I did a few scans with some of the well known Windows malware scanning tools, all the while thinking… why didn’t McAfee catch this? After two hours of scanning and no positives on the scans, I decided to rebuild the machine, but declared that I would begin on it the next day.

Well… turns out, McAfee was the issue. I got an email from them that read in part like this: “Our initial investigation indicates that the error can result in moderate to significant performance issues on systems running Windows XP Service Pack 3.” Moderate to significant? One person affected couldn’t get on the network, had no taskbar, and their computer was auto rebooting… That sounds more like extreme systemic failure! :-)

For verification of the issue, see the following screenshot:

zero_byte_svchost.jpg

Here are some steps I took to fix it (taken mostly from the following website: http://brianseekford.com/index.php/2010/04/21/how-to-fix-the-mcafee-svchost-crash-from-the-virus-definition-update/)

  • Boot workstation in safe mode and login as an administrative user
  • Press the following keys: CTRL-ALT-DEL.
  • Click the “File>Run” menu item, type in “cmd”, and press the “Enter” key
  • Run the command: del “C:Program FilesCommon FilesMcAfeeEngineavvscan.dat”
  • Next, we have to copy a replacement svchost.exe from the system if available. Some have found it in “c:windowssystem32dllcache” and I found it in “C:Windows$NtServicePackUninstall$” so I will go with the instructions for what I had on this particular system…
    • within the “cmd” window type the following below:
    • cd C:Windows$NtServicePackUninstall$”
    • copy svchost.exe c:WindowsSystem32
  • Next, restart the workstation, login, and update McAfee to the latest dat file. As of this writing they have replaced the broken 5958 dat with 5959.
  • Once McAfee has been updated, I had to restarted the workstation again to get McAfee to report as being updated.

And more reading regarding the issue:

http://www.cnet.com.au/how-to-fix-your-mcafee-crippled-computer-339302608.htm

http://www.switched.com/2010/04/21/mcafee-update-sends-windows-xp-machines-into-endless-reboot/

http://tech.slashdot.org/story/10/04/21/1735211/McAfee-Kills-SVCHostexe-Sets-Off-Reboot-Loops-For-Win-XP-Win-2000

Office Compatibility

OpenOffice or Microsoft Office. Use either. It’s like OS X vs. Linux… whatever tool that is best for the job right?

Here’s how you can make the two play a little nicer…

OpenOffice

Users with older versions of Microsoft Office Products, including Word 2000/2002/2003, Excel 2000/2002/2003, PowerPoint 2000/2002/2003)

Users of Microsoft Office 2007

The network config

My network setup is going through a transitory phase as I swap parts and move things around. Here’s what I have to work with:

  • Desktops:
    • Pentium III-800 MHz with 256 MB RAM and two 300 GB PATA hard disks (currently running Apache/WebDAV as well as network backups)
    • Pentium III-850 MHz with 256 MB RAM and one 100 GB PATA hard disk (currently running a MythTV backend on the basic cable TV channels)
    • Pentium IV-2.4 GHz with 2 GB RAM and two 80 GB SATA hard disks (currently running Ubuntu 8.04, MythTV frontend, development station, etc)
    • Intel Core 2 Quad – 2.33 GHz and one 600 GB SATA hard disk (currently running Kubuntu 9.04, MythTV frontend, VirtualBox w/Windows XP, taking the place of the previous MythTV frontend and the XP install on the Compaq Presario)
  • Laptops:
    • Compaq Presario X1000 – Pentium M – 1.4 GHz with 1.5 GB RAM (this has been mainly used for presentations, wireless development, web development and our cordless Linksys/Skype phone)
    • MacBook Pro – Intel Core 2 Duo – 2.53 GHz with 4 GB RAM (this will be the successor to the Compaq laptop)

I also have some other miscellaneous parts/systems that can be used as needed. My thought was to have one MythTV backend, that will also serve as a file share, and backups. This may present some problems with the bandwidth and disk speeds on the Pentium IV box, but that remains to be seen. I am hoping the newest desktop will continue to run some form of Linux, and XP Home virtualized to provide the cordless telephone service. And then finally the two laptops, for all their mobility as well as using XBMC for additional MythTV frontends.

Windows 7 – XP Mode

So I downloaded the Windows 7 beta, but never installed it (had to keep Ubuntu and MythTV going strong). To be honest, I have heard it is fantastic… what Vista should have been, yada, yada, etc. Anyhow, I just read that some of the editions of 7 will have “XP Mode”, sort of like Apple had “Classic Environment” when they moved to OS X from OS 9. XP Mode will in fact be XP running in a virtual environment. How cool is that? Maybe business IT will be more easily persuaded to move on.

Windows 7 gets virtual ‘XP mode’

Windows 7 Release Candidate 1′s Best Surprise New Features

Google News

XP License Availability Roadmap

Here’s what Microsoft has to say about when they will stop selling various Window XP flavors: (http://www.microsoft.com/windows/lifecycle/default.mspx)

Under the Support Lifecycle policy, Windows desktop licenses are available for four years after general availability in all standard product distribution channels (e.g. direct OEM, System Builders, retail, and Volume Licensing programs via licenses or via downgrade rights). Licenses will continue to be available through downgrade rights available in Volume Licensing programs after end of general availability.

Windows XP Professional
Date of General Availability
December 31, 2001

Direct OEM and Retail License Availability (end date)
June 30, 2008

System Builder License Availability (end date)
January 31, 2009

Windows XP Tablet PC Edition
Date of General Availability
February 11, 2003

Direct OEM and Retail License Availability (end date)
June 30, 2008

System Builder License Availability (end date)
January 31, 2009

Windows XP Professional x64 Edition
Date of General Availability
April 25, 2005

Direct OEM and Retail License Availability (end date)
June 30, 2008

System Builder License Availability (end date)
January 31, 2009

Windows XP Home Edition
Date of General Availability
December 31, 2001

Direct OEM and Retail License Availability (end date)
June 30, 20083

System Builder License Availability (end date)
January 31, 2009

Windows XP Media Center Edition2
Date of General Availability
October 28, 2002

Direct OEM and Retail License Availability (end date)
June 30, 2008

System Builder License Availability (end date)
January 31, 2009

2 Includes the 2002, 2004, and 2005 editions of Windows Media Center.
3 As of April 2008, Microsoft is extending availability of Windows XP Home Edition for OEMs to install on Ultra Low-Cost PCs. The new OEM end date will be the later of either June 30, 2010, or one year after the general availability of the next version of Windows.

A few more thoughts on this (and loop holes):
How-to get Windows XP past the June 30th cutoff (or not)
How to Get Windows XP After June 30

Giving your computer to hackers

If you use the Internet, and want a better life, look in the mirror, and repeat this mantra 3 times daily:

“Stop using Internet Explorer.”

Even the US Computer Emergency Readiness Team has said, “Use a different web browser” in reference to Internet Explorer. With as many flaws that this browser contains, it is no doubt the best decision you could make in regards to your browsing habits.

Think bugs, spyware, popups, viruses, trojans, fraud, identity theft and all of the other bad words that are related to Internet use. Yeah, that may go a bit overboard, but you get the idea… Internet Explorer does not adequately protect the user from the invasion of cyber-theives on the prowl. And yes there are others that do. For example, Opera and Firefox.

So… after saying all of that, read this: Internet Explorer currently has a flaw in it, that Microsoft has known about for some time that has no fix for it yet. Even in fully patched Windows XP SP2 systems. All you have to do is browse to a specially crafted website, and hackers can launch what ever program on your computer they feel like.

I will say that again… all you have to do when using Internet Explorer is click a link, and you could be infected. There are no known sites currently implementing this hack, but as in the past, it could only be a matter of days.

eWeek has an article on it: Zero-Day Exploit Targets IE.

Free Office Suite

Here it is, OpenOffice has just released version 2.0.

Some of the exciting features it has:

  • PDF export
  • Mail Merge Wizard
  • Highly compatible with Microsoft Word and Excel
  • etc, etc, etc.

Most importantly it is free and standards compliant.

Download it:
http://download.openoffice.org/2.0.0/index.html

Read about it:
http://www.openoffice.org/dev_docs/features/2.0/index.html

See it:
http://www.openoffice.org/screenshots/ooo20/index.html

For more information:
http://marketing.openoffice.org/2.0/featureguide.html
http://www.openoffice.org/

.doc and why it should go

Here is a beautiful example of why .doc should go the way other file formats have gone before it. It’s proprietary.

During the… Open Format Meeting that was held in Massachusetts by the Mass Technology Leadership Council in regards to the Commonwealth of Massachusetts adopting the .odf document format for official state business…

Microsoft National Technology Officer Stuart lectured Secretary Kriss on how Microsoft’s intellectual property is key to the company’s revenue generation and tax payments and then asked Kriss “Are you talking about extinguishing IP rights?” Responded Kriss:
Of course not. IP is extremely important, but when it comes to this specific issue and the definition of a file format, you can always make the claim of IP to the definition of a file format and that is any corporations or any individual rights to do so.. Its just that doesn’t serve the needs of a sovereign state. Here we have a true conflict between the notion of IP and the notion of sovereignty. I would say 100 percent of the time in a democracy sovereignty trumps intellectual property.

Okay, but what about in a business or a school? I do not think we should always strive for the easiest solution in the short run, because in the long run it can come back to haunt us. Think forced upgrades, information loss due to outdated file formats, inability to control the information contained in the file format, etc, etc…

This weblog article has a good summary:
Microsoft vs Mass.: What ever happened to ‘The customer is always right’?

For extended reading on the topic:
Carr gives Microsoft a taste of its own OpenDoc medicine (and I pile on)

Still using Microsoft Word?

Yeah, I know, I like grammar check too. I also, enjoy… wait a second, I think that is all I miss when I use programs other than Word, say OpenOffice. It is well beyond my understanding why people perpetuate vendor lock-in by continuing to use a program that has been made a commodity.

Think generic drugs. Does anyone buy Tylenol when they know they can get the same thing cheaper. It’s called Acetaminophen. Well, I don’t anyway… I guess you could buy specially packaged, elderly friendly, long lasting, Tylenol gel tab, eh… back to word processors… :-)

Anyhow, why pay the extra? In this case it is 100% more expensive to buy Microsoft Word, than to download OpenOffice. And, there are others who are tired of Word… and not just because it is expensive. John Dvorak of PC Magazine fame seems to think it is time to ditch the software.

And while you are at it, check out OpenOffice Impress. Think of all of those times you have used “Power Point” as an noun… “I am going to make a Power Point”… how about we change that to, “I am going to make an Impress Presentation”…

Yeah, it doesn’t sound as catchy, but I can still hope someday it will change. :-)

Browser Switch

Okay… I have hammered this subject a lot lately, but I thought I would throw out an interesting article. Microsoft’s online magazine Slate has published an article praising Mozilla Firefox as a step forward in web browsing, security, and usability.

View the article, then install Firefox, then add a few extensions to the browser.

Yes, I know it sounds -EXTREMELY- scary to install a new program… but your online security depends on it. If you don’t trust me, then trust Microsoft (via Slate magazine) and the US Government. They recommend a switch too.

What’s even better is you can use the same browser on Windows, Linux and Macintosh! It’s available on all three!

Oh, and if you are into Macromedia Flash, Java games, or other plugin trickery, you will want to read this little document on how to get those functionalities into Firefox. No, it really isn’t a big deal.