FAO any McAfee epo users

[Ev0]

You might have some fun tomorrow if these dats have gone out today

https://kc.mcafee.com/corporate/index?page=content&id=KB68780

DAT 5958 stuffs machines up with a false positive.

Our repository update isn't scheduled for the early hours of the morning so was able to stop this, but thought there might be someone here who might also like to know about this

 

[Ev0]

I wouldn't say McAfee is a load of crap, I'm not a fan of some parts of it but overall, as much of a ncessary evil av is, it's not too bad.

Looks like we're going to have to visit each desktop across all sites

Probably quicker to just rebuild them all remotely, imaging systme dependent that is.

Seems a lot of people have been hit, I'm wary about updating the repository now even though it's saying the latest version available is 5859.

 

[Ev0]

Won't work, trashing svchost.exe effectively removes network access.

What it even stops pxe booting?

I'd just send a ghost task to wakeup machines, it boots them straight into the ghost console and off we go. Doesn't need to be booted into Windows, although would need to get people to power off the machine first.

Luckily thought haven't had to bother, updatd to 5859 this morning and everything is fine.

Asked my wife if her place this morning was ok and whilst the main network was fine seems one of their telemetry networks was hit, doh.

 

[Ev0]

Yeah I read through that article, a decent way of doing it en mass.