On Wednesday (April 21st, 2010), the popular antivirus product McAfee released an update for Windows XP that flags the system file svchost.exe as a virus. As a result, XP systems with SP3 that have downloaded this update will enter a reboot loop and have no networking capabilities. Affected users will either see a Blue Screen of Death or get a DCOM error followed by a shutdown message.

The update with the false positive is the “5958 DAT file”, it was released on April 21, 2010 and will mark svchost.exe as the “w32/wecorl.a” virus.

Here is the official statement from McAfee:

McAfee is aware that a number of customers have incurred a false positive error due to incorrect malware alerts on Wednesday, April 21. The problem occurs with the 5958 virus definition file (DAT) that was released on April 21 at 2.00 PM GMT+1 (6am Pacific Time).

Our initial investigation indicates that the error can result in moderate to significant performance issues on systems running Windows XP Service Pack 3.

The faulty update has been removed from McAfee download servers for corporate users, preventing any further impact on those customers. We are not aware of significant impact on consumer customers and believe we have effectively limited such occurrence.

McAfee teams are working with the highest priority to support impacted customers and plan to provide an update virus definition file shortly. McAfee apologizes for any inconvenience to our customers

There is currently no fix available, however there are steps you can take to prevent it from happening if you have downloaded the update but it is yet to detect svchost.exe as malicious.