McAfee’s “DAT” file version 5958 is causing widespread problems with Windows XP SP3. The affected systems will enter a reboot loop and loose all network access. We have individual reports of other versions of Windows being affected as well.

Fix McAfee DAT 5958 Update Issues causes auto shutdown of the pc. McAfee already released a statement and already stopped the distribution of the 5958 DAT file. However, lots of PCs are already affected.

Fix McAfee DAT 5958 Update Issues | Auto Shutdown Problem

The problem is a false positive which identifies a regular Windows binary, “svchost.exe“, as “W32/Wecorl.a”, a virus. If you are affected, you will see a message like:

The file C:WINDOWS\system32\svchost.exe contains the W32/Wecorl.a Virus.
Undetermined clean error, OAS denied access and continued.
Detected using Scan engine version 5400.1158 DAT version 5958.0000.

Additional information from McAfee: http://community.mcafee.com/thread/24056?tstart=0
McAfee Knowledgebase Article: https://kc.mcafee.com/corporate/index?page=content&id=KB68780
EXTRA.DAT file: http://home.mcafee.com/VirusInfo/VirusProfile.aspx?key=265240.

Fix McAfee Pc AutoShutdown Problem

• win54 virus

According to researchers from TrendMicro, once the infected user attempts to log into Twitter, Koobface hijacks the session and posts a tweet on behalf of the user.

Would this novel feature allow the worm to spread even more efficiently? It largely depends on whether or not they’d remove the beta label from it, and go mainstream with the feature.

Once on the malicious site, the victim becomes assaulted with a fake flash update and the infection starts to communicate with Facebook and Twitter immediately after downloading two additional executables from a domain hosted in Belgium.  

Fake codec site:

Connections:



After attempting to spread the infection on Facebook and Twitter, the W32/Koobface.DU.worm further capitalizes on its efforts by installing the Adware/InternetAntivirusPro Rogue Antivirus.  

Twitter has responded to the threat quickly and have already made an effort of removing the malicious tweets. We detected around 100 still active malicious tweets at the time of writing this.

Visual representation of malicious tweets:

• hacking twitter
• koobface plurk
• how to hack facebook by koobface
• hack using koobface
• koobface polls
• spread
• koobface