False positive detection of w32/wecorl.a in McAfee 5958 DAT - 4/21/2010

McAfee inadvertently released a bad patch (DAT 5958) for its Anti-Virus software on 4/21/2010. For more information, please visit:

https://kc.mcafee.com/corporate/index?page=content&id=KB68780

To keep from getting this bad patch, it is advised to temporarily disable auto-updates. To do so, please read the directions below:

How to Disable McAfee Auto-Update for McAfee VirusScan 8.5 and higher for Windows
- Right click on McAfee shield on right side of task bar, select VirusScan Console.
- In VirusScan Console, right click on ‘Autoupdate’
- Select ‘properties’
- At the bottom of the properties window, select ‘schedule’
- In the next box de-select ‘enable’ and then click ‘apply’ at the bottom.
- Click ‘OK’ and then ‘OK’ again on the ‘Properties’ window.
- You may close the VirusScan console if ‘Autoupdate’ shows ‘Not Scheduled’.


How to Disable McAfee Auto-Update for McAfee Security 1.0 for Mac
- Click on the Red Shield icon with a white "M" in the upper-right corner and select McAfee Security Preferences…
- In the smaller General window that appears, click the Update icon
- now in the Update window, click Schedule
- In the pull down menu for "Check for anti-malware update, select "Never." ***NOTE: You may have to click the Lock icon first and authenticate as a local computer administrator in order to make this change.
- Click on the Apply button and quit out of McAfee.

For those users using the UH ePO server, the bad DAT file has already been removed and it will not be pushed out. The workaround from McAfee will be distributed via ePO.

McAfee is working to have a permanent fix for this issue today.