You will need another/previous.dat file for McAfee named extra.dat
1. Reboot machine into safe mode (WITH networking)
2. User needs to log into machine (or someone with admin rights logs in)
3. Plug in USB drive
4. Go to CMD window
5. CD to USB Drive (root)
6. Execute this command ‘extra.bat”
7. Click “tools” and then “unlock interface”
8. enter your admin password if needed.
9. Double click “Quarantine Manager Policy”
10. Click “Manager” tab
11. Find latest infection of “W32\Wecorl.a”
12. Right click on infection, click “Restore”
13. Click “Yes”
14. You should get message “All items restored”
15. Reboot – CTRL – ALT – DEL
16. Click “Shutdown” and then “Restart”
extra.bat:
copy extra.dat "c:\program files\common files\mcafee\engine"
"c:\program files\mcafee\virusscan enterprise\mcconsol.exe"
If you get an error about file in use while restoring svchost.exe, go to "safe mode command prompt only", and rename c:\windows\system32\svchost.exe to svchost.old, then you can start at step one and it will let you restore from quarantine
Slashdot Mirror
You will need another/previous .dat file for McAfee named extra.dat
1. Reboot machine into safe mode (WITH networking)
2. User needs to log into machine (or someone with admin rights logs in)
3. Plug in USB drive
4. Go to CMD window
5. CD to USB Drive (root)
6. Execute this command ‘extra.bat”
7. Click “tools” and then “unlock interface”
8. enter your admin password if needed.
9. Double click “Quarantine Manager Policy”
10. Click “Manager” tab
11. Find latest infection of “W32\Wecorl.a”
12. Right click on infection, click “Restore”
13. Click “Yes”
14. You should get message “All items restored”
15. Reboot – CTRL – ALT – DEL
16. Click “Shutdown” and then “Restart”
extra.bat:
copy extra.dat "c:\program files\common files\mcafee\engine"
"c:\program files\mcafee\virusscan enterprise\mcconsol.exe"
If you get an error about file in use while restoring svchost.exe, go to "safe mode command prompt only", and rename c:\windows\system32\svchost.exe to svchost.old, then you can start at step one and it will let you restore from quarantine