Centrality Ltd Deals With the McAfee 5958 Dat Debacle
Circa 2010



This was Centrality Ltd  original site.
Content is from its archived pages as well as other outside sources.



Providing high quality infrastructure design, implementation and support services since 1996, Centrality is a leading IT managed services provider. A clear testament of our commitment are the excellent, congenial, long-term relationships we have with our clients. Such relationships continue to form the foundation for our company’s growth. By availing themselves to Centrality’s agile and proficient use of technology as their strategic or tactical IT resource partner, our clients remain competitive and keep control of costs.

Cloud computing is now an established service utilized by the vast majority of businesses. The migration of CRM data and applications from physical in-house dedicated physical servers to the cloud began over 10 years ago. Creating your CRM infrastructure in the cloud is made easy with a Salesforce crm customization. Customizing Salesforce involves a team of specialists who can code new modules, either business logic, front-end components, or both, and use the Salesforce programming language, APEX, and the front end framework, VisualForce. Customizing the functionality of a Salesforce platform to your organization’s unique requirements will help keep the customers you have, win new ones, and drive your business growth more efficiently. We can help migrate, under a controlled plan, all or part of your existing infrastructure to the cloud. We will discuss your options so the final solution meets all your business needs

Our clients trust in our ability to handle any situation was on display on April 21,2010 when McAfee released an update to its antivirus definitions for corporate customers. McAfee's "DAT" file version 5958 caused widespread problems with Windows XP SP3. Many affected systems entered a reboot loop and lost all network access. The corrupted DAT file infected individual workstations, as well as workstations connected to a domain. For businesses that made use of  the McAfee ePolicyOrchestrator used to update virus definitions across a network were doubly hard hit. It appeared that the ePolicyOrchestrator caused a even faster spread of the bad DAT file. It was a disaster for many organizations and businesses, as well as individuals.

As Mike Davis, Managing Director of  Centrality Ltd prepared to leave work at 1.30 a.m. he told an interviewer via telephone that the buggy McAfee antivirus update problem took out PCs at about 40 percent of the customers of U.K.

The problem started late in the afternoon, Davis said. "We started getting calls about 4 p.m. U.K. time on our help desk from customers that were having their XP-based machines just reboot seemingly randomly," he said. After realizing that it was happening to several different customers simultaneously, Centrality quickly figured out that the problem had to do with McAfee's update, and started shutting down McAfee ePolicy Orchestrator management servers to keep the problem from spreading. By then, however, several thousand computers had disappeared from the networks it manages.

 

McAfee Dat 5958 Issue

UPDATE: 13:35 22/04/2010 (GMT + 1)

Description
The McAfee 5958 Dat is causing the SVCHost.exe (a critical Windows system file) to be classed as a Virus.  Cleansing action against this file is then undertaken making some critical elements of Windows cease to function.  Most critically systems are coming back up without any network functionality which makes remote resolution of the issue difficult.
Only Windows XP systems seem to be affected at this stage, although we have Windows XP machines with the 5958 update that are not affected.

McAfee have release two updates recently.  The first (Extra.dat) can be added to update 5958 to prevent the false positive from re-occuring.  The second is the the full 5959 DAT update.  However if you have machines affected by this issue, adding Extra.dat or DAT v5959 will not completely fix your PC.
We have a number of clients affected by this issue and have put some resolution steps together to resolve the problem.  Our recommendations are below:

Option 1 : Manual Recovery - Try this first

  1. Download the extra.dat file from McAfee (http://vil.nai.com/vil/5958_false.htm) and place on a USB stick (assuming no network access)
     
  2. As an administrator on the affected machine copy the Extra.dat file to the Engine folder

    On most machines this will be"c:\program files\common files\mcafee\engine" 
  3. Reboot your PC
     
  4. Log back on as an administrator user
     
  5. Run the following command: sfc /scanfile=\svchost.exe  eg:

    sfc /scanfile=c:\windows\system32\svchost.exe
     
  6. Reboot your PC
     
  7. Login and manually update your DATs to 5959 or above

Option 2 : Manual recovery (Safe Mode)

This process is useful when you can't get any files on to your affected pc (either USB stick, network, CD etc) as all recovery actions are performed with files already on your C: Drive

  1. Boot Windows in to Safe Mode
     
  2. Log on and get to a command prompt
     
  3. Using the command line, copy the contents of the McAfee OldEngine folder to the parent "Engine" folder.

    On most machines this will mean:

    copy c:\progra~1\common~1\mcafee\engine\oldeng~1\*.* c:\progra~1\common~1\mcafee\engine

    Note: You MUST use the 8.3 notation (e.g. with ~1)  for file and directories that are longer than 8 characters
     
  4. Using the command line, copy svchost.exe from the DLLCache to Sys32. 

    Again, on most machines, this will mean:

    copy c:\windows\system32\dllcache\svchost.exe c:\windows\system32
     
  5. Reboot your machine
     
  6. Go in to McAfee Console and prevent any automatic updates until you are confident it is safe to re-enable them.

Option 3: Automated recovery

Centrality has developed an automated recovery process that will enable remote networked machines to be recovered with minimal intervention, however Microsoft licensing may be required.

 



 

More Background on MyCentrality.com

MyCentrality.com is a surviving piece of British information-technology history associated with Centrality Ltd., a managed IT services company whose roots extend back to the mid-1990s. The domain is particularly interesting because its story spans several distinct eras of business computing: locally managed servers and Windows networks, the growth of outsourced IT support, enterprise cybersecurity, cloud computing, Microsoft-based managed services, and ultimately the consolidation of the managed-services industry.

Today, MyCentrality.com should not be confused with the current corporate website of Centrality. The site identifies itself as Centrality Ltd.'s original site and preserves material from archived pages along with later background information. The historical material is valuable because it documents both the services Centrality promoted and one unusually dramatic episode in its history: the disastrous McAfee DAT 5958 antivirus update of April 2010.

Centrality itself continued developing long after the MyCentrality.com era. It evolved into a substantial Microsoft-focused managed-services provider based in Bedfordshire, England, and in April 2024 was acquired by Birmingham-based Intercity. The acquisition brought approximately 100 Centrality employees into a combined organization of more than 325 people and created a business reported to have approximately £60 million in turnover.

The old domain therefore represents much more than a discontinued corporate web address. It provides a window into the development of a technology company that survived enormous changes in business IT over nearly three decades.

Centrality's Origins and Ownership

Centrality Ltd. dates to 1996. The current company's privacy information identifies the legal entity as Centrality Ltd., company number 03236716, registered in England and Wales. Historical UK corporate records also show Centrality Limited under that company number.

The company developed as an IT infrastructure, support and managed-services provider. Its early positioning emphasized infrastructure design, implementation and ongoing support rather than simply selling computers or software. This distinction became increasingly important as businesses began outsourcing more responsibility for maintaining their networks.

MyCentrality.com's historical corporate description emphasized long-term client relationships as a foundation of the company's growth. Centrality presented itself not merely as a repair service but as a strategic or tactical IT resource that could help clients remain competitive while controlling technology costs.

That philosophy anticipated the managed service provider, or MSP, model that became increasingly important during the 2000s and 2010s. Instead of calling a computer company only when something broke, organizations could delegate significant portions of their technology infrastructure, monitoring, maintenance and support to a specialist provider.

Centrality ultimately became part of a much larger organization. Intercity announced its acquisition of Centrality on April 25, 2024. Financial terms were not publicly disclosed, but the transaction reportedly turned Intercity into a roughly £60 million-turnover company.

Centrality CEO David Keeling joined Intercity's board as managing director of a new division. The arrangement is significant because it demonstrates that Intercity was purchasing more than a customer list. Centrality's Microsoft expertise, employees, certifications and organizational knowledge were central to the acquisition.

Location in Bedfordshire

Centrality became closely associated with Meppershall, a village in Bedfordshire, England. Its operating address was Arran Park, Chapel Road, Meppershall, Bedfordshire, SG17 5NQ.

The company's presence is substantial enough locally that Centrality appears in the Meppershall Parish Council business directory, which lists it at Arran Park on Chapel Road.

Although the setting is relatively rural, it offers useful connections to important transportation centers. Centrality's own directions described both Hitchin and Letchworth railway stations as approximately a 15-minute taxi ride from the office. London Luton Airport was also described as approximately a 15-minute drive away.

This location gave Centrality a base outside central London while still providing access to the wider South East and national transportation infrastructure. The company described itself in business directories as having national outreach and experience serving private, public and regulated-sector organizations.

The Bedfordshire operation remained important after the Intercity acquisition. Contemporary coverage stated that Centrality's approximately 100 employees would continue working from their Bedfordshire office during the integration.

What MyCentrality.com Offered

The historical MyCentrality.com material reflects a company moving from traditional IT infrastructure toward cloud-based services.

Centrality described itself as providing infrastructure design, implementation and support. That could encompass the numerous technical responsibilities required to keep an organization's computing environment operational: servers, desktop computers, networks, software, security and the relationships between them.

Cloud migration subsequently became increasingly important. The site discussed moving applications and data away from dedicated in-house physical servers and into cloud infrastructure.

It also discussed customer relationship management technology, including Salesforce customization. Historical material referenced APEX, Salesforce's programming language, and Visualforce, its framework for creating customized user interfaces. The underlying objective was not simply implementing software but modifying systems to fit a customer's actual processes.

That approach—understanding the client's needs and then tailoring the technology—remained recognizable in Centrality's later managed-services philosophy.

Centrality's Evolution Into a Microsoft Specialist

Centrality's later history became increasingly intertwined with Microsoft.

By the late 2010s and early 2020s, the company was promoting cloud-first workplace services built around Microsoft's ecosystem. A Centrality service brochure described managed Windows 10 environments, Microsoft applications, device management, security and different service levels delivered for a fixed monthly price per user.

The brochure also identified Centrality as a Microsoft Gold Partner.

Its "Connect by Centrality" proposition illustrates how dramatically business IT had changed since Centrality's founding. Rather than concentrating primarily on servers installed at a customer's premises, Centrality could supply a managed workplace in which devices, software, security, updates and cloud services were integrated into a recurring service.

The company's later capabilities expanded across Microsoft 365, Azure, Power Platform and cybersecurity. Centrality described its portfolio as including professional consultancy, managed services and managed security services.

By the time of the 2024 acquisition, industry reports described Centrality as one of the UK's most accredited Microsoft partners, with more than 25 years of Microsoft experience.

This became a major part of its value to Intercity.

The McAfee DAT 5958 Disaster

The event most closely associated with MyCentrality.com historically occurred on April 21, 2010.

McAfee distributed antivirus definition file DAT 5958 to corporate customers. Antivirus definition files tell security software what patterns and behaviors should be recognized as malicious. Unfortunately, this particular update incorrectly identified a legitimate and essential Windows component, svchost.exe, as malware.

The consequences were severe.

Affected Windows XP Service Pack 3 computers could lose critical operating-system functionality, including network connectivity, and enter repeated reboot cycles. Because the computers could no longer communicate properly over their networks, the very tools that corporate IT departments normally used to repair computers remotely could become unavailable.

Computerworld reported that the faulty update apparently disabled hundreds of thousands of computers. McAfee said fewer than 0.5 percent of its customers were affected, but organizations caught by the problem could experience widespread disruption.

Centrality became one of the companies quoted extensively in contemporary reporting about the incident.

Thousands of Computers Disappeared From Managed Networks

Centrality Managing Director Mike Davis told Computerworld that PCs were affected at approximately 40 percent of Centrality's customers.

Calls reportedly began reaching Centrality's help desk at about 4 p.m. UK time. Technicians initially encountered Windows XP computers apparently rebooting at random. Once the same unusual behavior appeared across multiple unrelated customers, Centrality realized that a common external cause was likely.

The company connected the failures to McAfee's update and began shutting down McAfee ePolicy Orchestrator servers in an attempt to prevent further distribution.

But the update had already spread extensively.

According to Davis, several thousand computers had disappeared from networks managed by Centrality.

The scale of the incident is particularly revealing because it provides a rare contemporary indication of Centrality's operational reach. This was not simply a local computer-repair shop dealing with a handful of PCs. It was managing networked environments containing thousands of endpoints across multiple customers.

Why the McAfee Failure Was So Difficult to Repair

The DAT 5958 incident exposed a fundamental problem with remotely managed IT.

Centralized management is efficient precisely because administrators can update or repair large numbers of machines from one location. But when a defective security update disables network connectivity itself, centralized management can stop working.

Centrality's historical instructions explained that DAT 5958 caused svchost.exe, a critical Windows system file, to be classified as a virus. McAfee's cleansing action could consequently remove or disable the legitimate file.

Computerworld similarly noted that affected machines could no longer be repaired easily across the network. Administrators might have to guide users through recovery procedures or physically repair individual computers.

For an organization with hundreds or thousands of PCs, that turns one erroneous software update into a major logistical emergency.

Centrality's experience became particularly useful to the technology press because its technicians were observing the failure across many separate client environments rather than within only one organization.

Centrality's Recovery Response

MyCentrality.com preserved detailed recovery procedures for the DAT 5958 problem.

Centrality provided multiple approaches. One involved installing McAfee's Extra.dat update, restoring svchost.exe using Windows System File Checker and subsequently updating the antivirus definitions to DAT 5959 or later.

A second procedure addressed machines that could not receive files through USB, CD or the network. Administrators could boot into Safe Mode and restore files already available on the computer, including copying svchost.exe from Windows' DLLCache.

Most interestingly, Centrality stated that it had developed an automated recovery process intended to restore remote networked machines with minimal intervention, although Microsoft licensing could be required.

That detail illustrates the difference between an MSP and an ordinary end-user support operation. Centrality needed recovery techniques that could work at scale because manually visiting thousands of computers was inherently inefficient.

Centrality's Role in Explaining What Happened

Centrality did more than repair machines. It contributed observations that helped explain why the incident had become so damaging.

In a subsequent Computerworld analysis, Mike Davis discussed configuration differences involving McAfee's Enterprise Policy Orchestrator. Centrality also observed that corporate customers frequently configured aggressive antivirus deployment because rapidly distributing legitimate security updates reduces the period during which systems are exposed to new threats.

Ironically, that best practice worked against administrators when the security update itself was defective.

The same infrastructure designed to distribute protection rapidly could distribute the damaging DAT file just as efficiently.

That is one reason the 2010 incident remains an instructive example in enterprise IT. Automation reduces human workload and can improve security, but automation also increases the speed and scale at which a mistake can propagate.

Press and Media Coverage

Centrality was not normally a company attracting mainstream public attention. Like many business-to-business IT providers, much of its work occurred behind the scenes.

The McAfee incident temporarily changed that.

Computerworld and InfoWorld both reported Centrality's experience, particularly Mike Davis's description of the number of customers affected and the thousands of machines disappearing from managed networks.

Centrality again received substantial trade and business press attention in 2024 when Intercity acquired the company. The acquisition appeared in MSP Channel Insights, ChannelE2E, ChannelLife, Technology Reseller, UK Tech Exit News and regional business coverage.

The tone of the 2024 coverage was very different from 2010. Rather than Centrality being cited as an operator responding to a technology emergency, it was portrayed as a strategically valuable Microsoft specialist.

Industry reports emphasized its Microsoft accreditations, cloud-first strategy, approximately 100 employees and ability to strengthen Intercity's managed-services portfolio.

Popularity and Market Position

There is little evidence that MyCentrality.com itself ever achieved mass consumer popularity, and conventional consumer traffic measures would be a poor way to judge its significance.

Its intended audience was primarily business organizations seeking IT expertise.

For an MSP, meaningful indicators of scale include customers supported, devices managed, technical certifications, staff, recurring relationships and the complexity of infrastructure under management. The 2010 McAfee episode revealed Centrality managing thousands of computers. By 2024 it employed roughly 100 people.

The acquisition also provides an external market validation of Centrality's accumulated capabilities. Intercity spent approximately 18 months developing the strategic acquisition, according to contemporary coverage, and explicitly highlighted Centrality's Microsoft expertise.

Intercity itself served more than 1,300 customers nationwide at the time. Combining the businesses produced a workforce exceeding 325 employees.

Reviews and Reputation

Traditional consumer-review platforms provide relatively little insight into Centrality. For example, Yell listings for the Meppershall operation have shown no public ratings.

That absence should not be interpreted as evidence of poor customer satisfaction. Enterprise IT companies frequently generate far fewer public reviews than restaurants, hotels or consumer retailers because relationships are contractual, technical and business-to-business.

More revealing are the descriptions surrounding Centrality's acquisition.

Intercity executives emphasized Centrality's customer relationships, people-first culture and technical capabilities. David Keeling similarly described Centrality's philosophy as treating customers as partners and being easy to do business with.

The fact that Centrality's employees and leadership were retained also suggests that the company's human and technical expertise constituted an important portion of the acquired value.

Awards, Accreditations and Industry Recognition

There is no strong evidence that MyCentrality.com itself won major website awards, nor does the available historical record justify inventing a long list of corporate awards.

Centrality's more meaningful recognition came through industry accreditation, especially its Microsoft status.

Historical marketing identified it as a Microsoft Gold Partner. By 2024, acquisition coverage repeatedly characterized Centrality as one of Britain's most accredited Microsoft partners. David Keeling stated that its credentials placed the company within an elite group of UK organizations.

For a managed-services company, such accreditations can be commercially more important than general business awards. They indicate verified technical competencies and the ability to deliver, support and manage technologies used by corporate customers.

Centrality's Audience

The company's natural audience consisted of organizations that needed sophisticated IT capabilities without necessarily wanting to build every capability internally.

That included small and medium-sized businesses as well as larger organizations and customers in private, public and regulated sectors.

The services became especially relevant to companies requiring Microsoft 365, Azure infrastructure, cybersecurity, managed endpoints, cloud migration, professional IT consulting and continuous support.

A 2023 supplier disclosure from estate agency Country Properties, for example, identified Centrality as its IT support provider. Such references illustrate the largely invisible role an MSP plays: customers encounter the client's business, while companies such as Centrality operate the infrastructure behind it.

Social and Cultural Significance

MyCentrality.com is culturally interesting because it documents a transitional period in computing.

When Centrality began in 1996, corporate computing commonly meant desktop PCs, local networks and servers physically located inside offices. Over the following decades, IT shifted toward virtualization, software-as-a-service, cloud infrastructure, subscription licensing, mobile working, remote management and increasingly sophisticated cybersecurity.

Centrality adapted to those changes.

The McAfee episode represents another important aspect of modern technological culture: dependence on automated systems. Businesses need rapid security updates because delaying them creates vulnerabilities. Yet the same automated distribution mechanisms can amplify a defective update.

Centrality's experience in 2010 was therefore an early and dramatic demonstration of a problem that has become increasingly important as organizations depend on interconnected cloud and endpoint-management systems.

From MyCentrality.com to Centrality.com and Intercity

The evolution of the company's web identity mirrors the evolution of the business itself.

MyCentrality.com belongs principally to Centrality's earlier online history. Centrality later operated through Centrality.com, where its messaging increasingly emphasized Microsoft cloud technology, cybersecurity, consulting and managed services.

Following the April 2024 acquisition, another transition began.

Intercity eventually announced that Centrality had relaunched as Intercity. The Centrality brand was being absorbed into the larger group, while its people and expertise remained part of the combined organization.

The old Bedfordshire company therefore passed through three recognizable web and corporate eras: the MyCentrality.com period, the mature Centrality.com Microsoft-services period, and finally integration into Intercity.

The Continuing Legacy of Centrality

Centrality's history is notable less because of a single product than because of its longevity.

A technology services company established in 1996 had to survive extraordinary industry change. Technologies that once formed the center of business computing became obsolete. Local servers increasingly gave way to cloud platforms. Software moved toward subscription models. Cybersecurity became a board-level concern. Remote work expanded. Microsoft transformed from primarily a desktop-software company into one of the world's largest cloud infrastructure providers.

Centrality continually repositioned itself within those changes.

By 2024, the business had accumulated enough Microsoft capability, customer relationships, technical staff and managed-services expertise to become a strategic acquisition for a substantially larger UK technology company.

The McAfee DAT 5958 incident remains perhaps the most vivid episode preserved by MyCentrality.com. It showed Centrality confronting a crisis affecting thousands of computers, diagnosing a problem spreading across multiple clients, limiting further deployment and developing recovery procedures when ordinary remote-management methods were compromised.

But the broader history is equally revealing.

MyCentrality.com represents an earlier generation of the managed IT industry—a period when companies were learning how to outsource increasingly complex technology environments to specialist providers. Centrality's subsequent development into a highly accredited Microsoft specialist and its eventual acquisition by Intercity demonstrate how that industry matured.

For researchers encountering MyCentrality.com today, the domain is therefore best understood not simply as an old IT company website but as an archival doorway into the history of Centrality Ltd. It connects a mid-1990s infrastructure and support business, one of the most notorious enterprise antivirus failures of 2010, the transition to cloud-first managed services, and the consolidation of Britain's modern MSP sector.

 

Centrality Ltd accepts no liability for any loss or damage incurred when following these instructions.

Centrality Ltd:
Telephone: 0845 2300 411
Non-UK: +44 (0) 1462 810 628
Email: admin(at)centrality.com

 



MyCentrality.com