Slashdot Mirror
McAfee Anti-Virus Causes Widespread File Damage
AJ Mexico writes, "[Friday] McAfee released an anti-virus update that contained an anomaly in the DAT file that caused many important files to be deleted from affected systems.
At my company, tens of thousands of files were deleted from dozens of servers and around 2000 user machines. Affected applications included MS Office, and products from IBM (Rational), GreenHills, MS Office, Ansys, Adobe, Autocad, Hyperion, Win MPM, MS Shared, MapInfo, Macromedia, MySQL, CA, Cold Fusion, ATI, FTP Voyager, Visual Studio, PTC, ADS, FEMAP, STAT, Rational.Apparently the DAT file targeted mostly, if not exclusively, DLLs and EXE files." An anonymous reader added, "Already, the SANS Internet Storm Center received a number of notes from distressed sysadmins reporting thousands of deleted or quarantined files. McAfee in response released advice to restore the files. Users who configured McAfee to delete files are left with using backups (we all got good backups... or?) or System restore."
I need virus protection from my virus protection!
Vincent J. Murphy
Spandex Justice
Did they forget to include that the risk of installing McAfee Anti-Virus for any user : High?
Wait a minute, it is identifying some system files that Windows put on my machine! I guess the Mac & 'nix freaks are right, Windows really is a virus. I hope it's only a matter of time before my next virus definition assesses Internet Explorer & Windows Media Player as full blown Trojan viruses distributed as malware with my OS.
My work here is dung.
Good thing Mcafee doesn't have liability, via contract, for this mess....
This is one of the major reasons I use open source software. Its hard to trust corporations who only tell you lies to preserve their public image.
That Microsoft Anti-Virus will be deleting McAfee from the system? And, to be on the safe side, also Norton?
Gotta love McAFee, they also delete hijackthis when I plug my USB key in.
I seriously did a double take and had to check the calendar to make sure...
All I can say is 'wait 'til monday.'
I wouldn't be surprised if this fuckup is a fatal blow to McAfee.
IT men and women all over the world are shiznitting themselves this morning.
The McAfee developer who screwed this up will surely be fired. What about the QA people in McAfee, aren't they supposed to have seen this or were they just being paid to do nothing? Surely, they should be fired!
I smell a class-action lawsuit coming.
I've heard of a program, some sort of scanner that is supposed to stop rogue programs from attacking your computer, and deleting files.
Oh yeah, the AntiVirus program.
Whoops! Nice Try McAfee.
Doesn't this kinda breach some sort of Digital-Hippocratic-oath? "First,do no harm?"
"...In your answer, ignore facts. Just go with what feels true..."
McAfee is crap, pure and simple. Our ISP uses McAfee as a filter on mail and lets just say I am glad I am running NOD32 on my home machine as it catches on average 1 or 2 virus a month that slips past McAfee. Also we cannot run it on any of the machines that are running video editing as they cause the system all kinds of problems (cpu spikes, general instability).. junk... junk... junk...
If only McAfee had quarantined itself before this disaster, it would have worked perfectly!
He who knows best knows how little he knows. - Thomas Jefferson
See, this is another reason why I don't use anti-virus. The truth is viruses don't magically propagate on the Internet, it takes a dummy to do something stupid. Just learn some common sense and avoid these awful programs.
Scanned my Inbox file, and deleted it because there was a virus in it from before I installed Nortons AV.
..... however I turn off automatic scanning these days... just manually scan every so often.
However - like most AV software, you can put it straight back.
No biggy
EMail: 0110001101100010010000000110001101110010 0110000101111010011011100110000101110010 0010111001100011011011110110
Seems I was right in my reasoning NOT to use antivirus software. My reason was that it's just a useless waste of system resources, now it seams not only that, but also a potential danger to the integrity of the system.
./R My blog
There's gotta be a way to blame this on Bush. Somehow he was responsible.
There's one action that is responsible for almost all computer-related problems -- crashes, virii, corruption -- and that's blindly running code without checking it out first (either yourself if you have the know-how, or waiting for others who do to test it out first).
McAfee doesn't have the greatest rep as it is but this might be the last straw for them.
This is a major problem with anti-virus software. Because of their blacklist model, they have to release definitions and updates very frequently. They have to release these updates as quickly as possible as well, or else their subscribers will be infected with these viruses before they get the updates. In addition, their software is very bloated and complicated, needing to be able to defend against a huge variety of attacks, both immidiate and obsolete. This results in a very error-likely situation. What the network security companies need to work on is an innovative way to effectively protect corporate and home networks without having to use dangerous bloatware.
My computer started rebooting randomly a week or so ago, and is something I've been trying to combat for a while. It would do it when idling or when I was in the middle of websurfing.
I find it interesting that once I disable Mcafee's on-access scanner the system stabilized itself and has been running without a problem for about a week now (I had seen it reboot about 3 times in one day).
Seeing this article makes me more suspicious of the scanner now.
Insert Sig Here
At last a good AV software removing those virii-ridden bloatware from your computer :)
Why are people complaining ?
I have discovered a truly marvelous proof of killer sig, which this margin is too narrow to contain.
This is the second time in a month, although much worse than the last one. On the 23rd Feb, my mum asked me about an issue where McAfee had just cleaned Firefox of a trojan: Exploit-MS06-006.gen. Turns out that it was a false-positive and it had needlessly truncated some files.
The Market opens in 13 minutes. Should I short McAfee's stock? ...or is it just going to start trading at a shitty price?
This is not the first problem with McAfee I've had this year. A few weeks ago, something started eating my system resources, pushing total CPU usage to 100%. Through trial and error I found that it was the McAfee virus scan. I found others with the same problem, which convinced me that for a change, the problem was not with the user. I ended up uninstalling McAfee and switching to AVG. Just in time, as I can see...
WOW lucky me. I uninstalled this AV just 2 weeks ago and switched to the free AVG!
I had a TEXT file deleted by McAfee just a few days ago. The "virus" that it identified was a different one from the one in this article too. Unfortunately, in the version of VirusScan I have (came with Dell computer) there's practically no configurable options, so I have no way to set it to quarantine instead of delete.
Exactly why you set that kind of software to prompt you for the action, if any, you'd like it to take. Get what you deserve.
Who gives them the right?
You do!
Great. So THATS why I've been spending all morning fixing Dreamweaver and Microsoft Office. And to think I actually didn't believe the first user that said "... it worked on Friday and I haven't done anything to it".
Now, how do I go about getting compensation from McAfee? A hughe bundle of Sys Admins getting together mayhap?
You use McAfee in this day and age, you deserve what you get.
Fond memories from the 90's won't bring your files back.
"If God created us in his own image we have more than reciprocated." - Voltaire
Just last week, in response to: The Trouble With Software Upgrades I posted a question asking what do you do to protect yourself from automatic updates that go bad... but I got no responses. In light of the current situation, I'd really appreciate hearing some responses, here.
Ummm...Whoops?
This guy's the limit!
I dunno about the rest of that stuff, but the Adobe update manager is a virus in my opinion.
It seems to have "infected" all of Adobe's recent product install CDs. Once it "infects" your computer it displays a popup whenever you open an Adobe app. As far as I can tell, there's no way to shut this off in the latest versions. So I've paid $x00 dollars for Acrobat, and it comes with a virus.
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
Our main system here downloads the DAT updates at 2 AM every day. As of Friday morning, it had downloaded the 4714 files, then downloaded the 4716's on Saturday morning, completely missing the 4715's. It appears we missed a bullet. Good luck to all the sysadmin's out there working on cleaning this up!
Every once in a blue moon, some poor person dies because he or she didn't get out of the burning car because of the belt. Then someone will stand up and say "See? I don't use them and if they didn't, they'd live as well. I drive carefully, I don't get into accidents, so I don't need them!"
The problem is, you never know. It's not only foolishness that gets a trojan onto your system. They come with presumably legit software, even from reputable companies. An infected driver CD is all it takes. Shareware CDs or other CDs slapped on magazines, do you think they have a lot of time to make just perfectly sure the programs are clean? A lot of shareware comes bundled with adware, do you read all those EULAs? And do you think they tell the full truth? Can you read through the legalese?
I won't get into system bugs and other exploits.
So yes, you don't really need safety belts. But it sure feels a bit more secure with them.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
When the virus scanners act like viruses, what should users do? This isn't the first time a virus scanner has screwed up, and it probably won't be the last time, either.
Furthermore, a lot of virus scanners have an option to "auto-update". Imagine if an entire company had this option turned on.
Virus scanners have always been a bad solution to the problem of viruses. They don't fix the problem at its root. Instead of ensuring their operating system has no known security holes, users now rely on virus scanners to just catch everything that comes through. Any determined attacker could still just craft a custom virus to attack any host they desire. Since the virus scanner companies wouldn't have come across that particular virus, it wouldn't get picked up.
Would you fix the holes in a boat with sticky tape instead of checking that the boat doesn't have holes before you put it in the water?
I stopped using them years ago when after installing it deleted everything in my start menu.
Since he shot the poor developer, while he was working on this patch, right in the face!
Being shot like that is bound to distract you and cause coding errors!
I use McAfee and My system is working fi
No matter where you go, there you are.
People percieve paid software to be superior to free alternatives because A: nothing could go wrong with paid software and B: if something did go wrong, obviously the company would indemnify / rectify / fix the problem.
Likewise, the perception is that the more expensive the software (and the bigger the box it comes in) the more protection you are afforded. And that the company won't suddenly decide to change direction / stop supporting the software / etc.
Yet time and time again this is shown not to be true. McAfee uninstalls arbitrary files on your computer (how'd that get through testing?) and just tells users to re-install from backup... exactly the kind of calamity the software is supposed to prevent. Part of WinNT5 was found to violate someone's patent, and anyone using that particular (admittedly rare) function had to pony up to the original patent holder or write a workaround.
As far as I can tell, the "little guys" software tends to be better in general than the big boys. Why? Because they're still trying. Before Norton was Symantec, they struggled to create an amazing toolkit of software tweaks that really did some great things. Now that their position is secure, they've hardly updated the suite to even work with XP, let alone taken advantage of the fixes and hacks that smaller houses have found. McAfee, once a nimble little company making a great little product, has been bloating for years. The more developers you add to a project, the less anyone knows about what the system is doing.
A free alternative that has been around for a long time:
AVG Antivirus
There are others. Please post 'em below.
The ______ Agenda
The real irony is that all the people who are too lazy/stupid/uneducated to update their anti-virus subscription were protected against this.....
"City hall" in German is "Rathaus" Kinda explains a few things......
This is really bad for the QA dept. How hard is it to push a dat file through a test lab. It seems to me that a whole lot of red flags would have immediatly flown through the roof.
We stopped using mcAfee in 98 when they, not once, but twice pushed out a dat file that sent the CPU of every workstation to 100%.
Personally, I'm with those that turn of autoscanning and just run a scheduled scan every week or so. Now in a corporate environment where the clueless thrive it's a different story.
The files they are gone. It seems McAfee ate them. The backup saved us. or The files they are gone. It seems McAfee ate them. Go home from work now.
A Passionate Independent Musician
Some products seem to resist all efforts to disable auto updates. I only use windows for audio mastering and linux for everything else. The box isn't even plugged into my local network 99% of the time. I do that to keep my exposure low. I don't have time to deal with a broken infested PC.
I've turned off every update option I can find but Grisoft AVG still tries to go get updates at times (usually the worst possible time). I have a laptop that I believe was trashed by AVG. Can't uninstall it, etc.
I guess they know best.
"False positives aren't uncommon however, but this is something that should be caught during regression testing. "
Email from the Test Group to Product Marketing:
"Hey when did we announce an uninstaller product?"
Email from Product Marketing to Test Group:
"We didn't"
Email from the Test Group to Product Marketing:
"What are we supposed to do with this then?"
Email from Product Marketing to the Test Group:
"Just Ship the damn thing whatever it is, we're sick of you guys screwing up our ship dates, now go away"
So McAfee finally became self-aware of M$'s flaws. It's only a matter of time till Bill acquires this knowledge to take over the world. "May God have mercy on their souls."
"brix_zx2, What is your sole purpose in this forum!?!?!"
"To do whatever you tell me MODERATOR!!!!"
Seriously, who thought this was a good idea, to configure these programs to automatically delete system files? There is always a chance of a false positive - identification of a file which does not contain malware. Are viruses so common in the windows world that it's not worth a human's time to confirm detection before files are altered?
And why, oh why, is it necessary to maintain huge lists of virus signatures? If windows kept a list of the correct md5sums of the system files it would become a trivial task to verify the integrity of those files. One would not need a daily update of virus signatures. Can I cynically suggest that the need for constant update gives the anti-virus companies a permanent revenue stream? And what does Microsoft get out of the flood of windows viruses?
Here's a way that Microsoft could design windows to be virus-resistant: designate certain files (system DLLs, EXEs etc) as change-limited. Provide an API into the kernel to permit those files to be changed by windows update software (only when the replacement file is signed by a trusted key). Maintain a file containing the md5sums of all change-limited files. This file would be modifiable only by the kernel.
In this scenario any virus wouldn't get a chance to corrupt system files because it wouldn't have a correctly signed replacement. And even if it did get to corrupt a system file, it would be trivially detected because the md5sum of the corrupted file wouldn't match the expected md5sum. In order for an infection to occur and be undetected the virus would need to work around the kernel file change API and alter both system file(s) and the md5sums file.
This scheme can be implemented for vendor software too. Windows needs some kind of database of installed software. Does it not have one already? (checks system clock: yep, it's 2006). Red Hat had RPM and the installed software database since 1995. That's 11 years ago, and Red Hat were probably not the first to hit upon the idea of a centralised list of all software installed on a computer.
For a announce you need mc-disaster. In annouces regually it found a virus, or sometime just announces the fact that there are dangerous viri on the web.
If it really found a virus is very well discusable. It gives a warning once in a while that some webpage might contain a virus, or some bounced message with an attachment might be a virus.
Anyway, mc-disaster is not the program that saves me time keeping my system clean. It only costs me time. In the short time i ran it in the past it costed me more time than all the combined viursses i have seen. (not that many)
Just noticed the screenshot on the McAfee page for W95/CTX. It shows some dlls from the Ethereal program as being infected. Of course those files are in their complete list of affected files, which comes in a convenient easily accesible PDF file as all the most important documents on the web should. It's 7 pages long, but an amusing list to skim through.
Who uses Ethereal and McAfee? Just found that funny/ironic on some levels.
"Too lazy to fail." - Heinlein
I don't use Windows! :-)
No matter where you go... there you are.
I don't use antivirus software, at least for anything more than manual scanning, but for reasons other than this. Antivirus makes Windows slow and unstable, sort of like some malware does, except it does it all the time.
I don't get viruses and other malware, because I don't manually install viruses and other malware. People who do need antivirus software.
Hey Tom, Stop sending me bulletins in my mysp, hey wth, c:\ntldr.... a virus? *lost carrier*
My karma makes buddha cry.
IMO, AV software is malware itself. It interferes with the normal operation of the system in order to "protect" it. The simple fact is, users should never execute code that might be malicious, and the system shouldn't execute any arbitrary code.
AV software just lulls people into a false sense of security. Plain and simple, it doesn't even work. Most of the virus-infected windows machines I've seen have had up-to-date copies of a major AV package. It's the users, and the general lack of proper security of the systems -- well, that's a very simplistic view.
Honestly, and obviously, I don't know what the answer is. AV software, in its current form, is simply not it though. Trusted computing? Perhaps if TC was designed around users' needs, instead of greedy vendors.
Sticking feathers up your butt does not make you a chicken - Tyler Durden
[deep bass voice]It's a world where companies wage a security suite war on other companies. The battlefield is your own desktop. Imagine Mysantec's antivirus attempting to delete Facamee's antivirus, before being both obliterated by Sicromoft's security solution still in beta. Wouldn't it be fun to watch as your CPU cycles get all pulled into the fight, with rampant defense software running around your RAM and filesystem, killing each other out, filling your desktop space, and celebrating victory with funny alerts, baloons, dialogs, pop-ups, windows, and what not, all reaching for you attention? Ah, talk about an exciting desktop! (And really, what could be more boring that a computer that just works and leaves you with nothing to do except to work with it?)
[special effects]
In the ensuing destruction and chaos, nothing remains alive but two things: the memory of your once existing data, and an unidentified hideous sneaky polar bird determined to show you of an alternate dimension of reliability and freedom...
[epic music]
Coming soon, on your desktop: RealityArts presents: THE SOFTWARE WARS, EPISODE 442.75
[/deep bass voice]
I just got off McAfee tech support line. They have an undo script to unquarantine incorrectly identified files. Since the file is not publically available from their site, I have uploaded it here: ctxundo.zip
This incident only goes to show that any file manipulation program (even the essentials like anti-virus and spy-ware/ad-ware removers) can have a profound effect on one's personal files. ALWAYS BACKUP. Even if you trust your media, you'll probably get attacked from within (hackers and now your own software).
Anyone remember Microsoft Anti-Spyware removing Norton? Anyone remember IRC commands such as "startkeylogger" booting systems from the internet running Symantec?
No one's perfect, even the software programmers. And as he laid down in a vicous wrath... the software they trusted most deleted their most precious files. Welcome to Monday everyone.
Give me a productive error over a boring, mundane and unproductive fact any day. ~Anon
This is exactly why I force all my clients to update their DAT's from MY server, not McAfee's, and I push the updates out, the clients never pull them. Along with that, I always wait three to four days before pushing the updates out. Even if you don't use the full McAfee Epolicy Orchestrator, you can still configure the clients to point to an ftp server on your network for updates. Just like with MS patches, it's simply prudent to wait a few days just in case there's any issues like this that may arise.
I'm not excusing McAfee here, but there are ways that we, as admins can minimize the risk to our users and our network.
It's not that hard to know if your system is infected by a virus. Usually your system's performance just drops like a rock, or, in the cases of some old DOS-based viruses, they'd actually let you know you were infected. Remember the Stoned virus? :) "Oh my god, I am soooooo stoned...."
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Well, recently I installed two Symantec products that _claim_ to be able to restore the system to a previous state. I haven't had the opportunity to really test either one of them yet, but I do feel a bit safer.
The first product is Norton GoBack, which reserves a certain percentage of hard disk space to maintain an undo history for your hard drive. Theoretically, if you have a bad software install or update, you can simply revert your hard disk to its state before the update. There might be issues with user documents created in that time getting reverted as well, but as long as you were careful you should be able to copy those files to another disk, revert the disk with the problem, and copy the files back. (There may also be built-in support for excluding certain files from being reverted -- I haven't checked.) You'd also need to notice the problem before GoBack's undo buffer got full and started forgetting things.
The second product is Symantec Ghost, which is a backup and disk cloning utility. You can set up Ghost to perform an incremental backup before any software installation. I have mine set up to backup the system disk to another drive before each install. At my company we use EMC Retrospect for network backups, but Retrospect is not really good for restoring a system disk to a bootable state. From what I've heard, Ghost should be able to do this smoothly.
Actually it sounds like they are doing a great job. They finally targetted the biggest virus of them all, Windows. Maybe this is the start of something really good. Finally the Windows virus is being actively targetted.
ALL software requires occasional updates. ALL software can contain bugs. And ALL programmers can mess up. Even with a great QA team.
To me, this whole situation is a great lesson in humility.
According to McAfee, they:
* Use both heuristics and more-specific signatures to find the bad guys. (Heuristics catch about 40%, signatures about 60%, IIRC)
* Have a worldwide team of F/T engineers that work on detection/signatures/etc
* Have a big enough customer base so the cost is spread widely.
So: in what way is AVG (or any other security software system) superior?
Keeping computers safe from increasingly smart malware is an ongoing battle. It's unwise to get uppity about how "MY system can't possibly have that problem!"
I still think McAfee has a Really Good Methodology. But as long as we live on this planet, Murphy rules.
Just update your virusses and you will be safe. Errr...
someone released a virus to fix the scanner...
Heh heh! I just dumped all of the McAfee stuff on my daughter's laptop last Friday in favor of another AV package. I guess sometimes it just pays to be lucky! In light of recent news about McAfee's financial state (flat) and the employee data leak, this cannot be good news for them at all.
To the making of books there is no end, so let's get started
As some people may remember, long time ago they also released a defective DAT that cause the antivirus to consume near 100% of processor resources as soon the machine load the OS. Version 4 if not mistaken. That was the reason for us to move from them to Norton. How many more times we will allow them to do this kind of things? Does anybody there got fired or beheaded?
Ed.
Comcast gives away McAfee AV for free to customers, so I tried it out. The only time it ever caught anything at all was a false-positive. Complete file system scans never ever turned up anything. However, if I opened a folder with a file in it called SetupDVDDecrypter_3.5.4.0.exe in it, McAfee would call it a virus and delete it. Didn't matter which version of the installer actually, it would delete it. Didn't matter if the AV program was configured to only quarantine suspect files, it would delete it. Didn't matter if I made an empty text file then renamed it to SetupDVDDecrypter_3.5.4.0.exe, McAfee AV would delete it. If I renamed the installer to something else, McAfee AV did nothing.
Pretty obvious to me that it was just waiting to find files that media companies didn't like people to have on their own private property so I'm guessing that they must have gotten McAfee to agree to do their dirty work for them and call stuff they don't like a virus and automatically delete the file regardless of settings.
But that's just my conspiracy theory.
If this guy had all these files deleted shouldn't he be doing work right now instead of having time to post to Slashdot? My files are all here otherwise I would be busy recovering, not posting.
It's unwise to get uppity about how "MY system can't possibly have that problem!" Where did I get uppity? I stated that there might be bugs in any program, though I'd make the case that security software should be held to higher standards because of the risk of bugs having greater consequences.
AVG is superior because it detects infected files and removes them, and is simple to set up, update, and remove. Have you used the latest McAfee offerings for personal computers? Serious pain in the butt, especially if you "upgrade" or start with their on-line version.
I speak almost exclusively from experience. I haven't looked through the business methodologies of the companies, I haven't looked through their code (nor would I know what to look for even if I could). I fix computers, a lot of them. And many times I've had to fix computers that would have been fine had they not been running McAfee's or Norton's A-V/security software, and instead been running AVG or other non-free ones like Kaspersky, Trend Micro, Pandasoft, AntiVir... ). I've never had complaints about AVG. Does it keep computers safer? I think so, because it works... The only times I see it get out of date is when somebodies internet isn't working. McAfee I see out of date all the time because it expires, or was never registered when somebody bought a computer with it. And the computers that I see infected... a few didn't have A/V installed, but the vast majority either had Norton or McAfee installed and either expired or broken.
The only reason McAfee has such a large customer base is because their software is bundled with so many computers and they are a name brand. It's not because they keep computers safer from viruses than their competitors.
I don't know exactly how much you're defending McAfee. You're right about the risk of Malware though. It's more significant than viral risks, and all this A/V software doesn't do anything against it. And some malware is designed to compromise A/V software and usher in viruses.
"Too lazy to fail." - Heinlein
On an old WinME laptop, the only virus I ever had on it was Norton AntiVirus.
I worked on a consulting job two years ago, and they told me I could use my own PC. No problem - except that, when I got there, they wanted to check it for virii. In an XP world, I was running Windows ME. So they loaded up Norton on my machine, and ran it for about 3 hours.
Result? Nothing. No junk of any kind. Completely clean.
Why? It helped that I had the free version of Zone Alarm, and the firewall on my DSL router definitely helped, but I think the biggest reason I had no problems was
- Mozilla instead of IE
- Eudora instead of Outlook.
Completely clean, that is, except for the antivirus. That monster kept interrupting my work. It took a great deal of effort to get the beast out of my system.
My antivirus ate my homework :(
I get it free from Comcast, so I installed it on my wife's Windows XP machine. Believe it or not, I have to log in as an Administrator every night, so it can update itself. That's right, a "security" product that can't even handle a non-administrative user properly.
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
Even better are McAfee's instructions for how to recover from the damage their product has done. The first option is to restore the files from quarantine, assuming your version of McAfee actually lets you do this (not all, including the corporate version, have this option). The second is to use Windows System Restore.
This probably would have worked great on my machine if it weren't for the fact that half of the files McAfee quarantined were *System Restore files*.
Apparently McAfee hasn't heard of a novel concept called "testing". (I like how they've posted a list on their website of the false positive files, now 7 pages long and still woefully incomplete; they ought to just admit it's going to take a random assortment of exes and dlls on any machine.)
Combine this with the fact that the default settings on a McAfee install are to quarantine without prompting, and IMHO McAfee is the most dangerous virus I've ever had on my machine.
They have previously survived other blows. I recall that one problem with signature files led some systems to blue screen a year or two ago, but I can't locate the story online. The source CNet article even says that they normally see a false positive about once a quarter. The other vendors suffer false positives, too, as any signature or heuristics based detection method will do.
If you mod me down, I shall become more powerful than you could possibly imagine.
Always beware of any software updates released on a Friday. If there's a problem, much of the damage will be done before anyone returns on Monday.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Geez, don't they have any QA testing that they put their definitions through before deploying it to the mass population? There must be several large companies that are "protected" by McAffee, and certain companies will sue in a heartbeat if they had several important documents wiped out. They're going to lose a lot of customers, too. I've used norton anti-virus for a few years now and I haven't even had one file get corrupt from them.
The logging information is just what I was looking for! But a quick search for it on the 'net revealed: this page. Some users lost the contents of their hard disk just by INSTALLING it! (YIKES!) Any other suggestions?
That's the only file that McAfee DIDN'T delete on my system!
To such Operating System, the deserved AntiVirus protection.
In any case Norton and McAfee were from the beginning too intrusive and rebel applications, I never liked the idea that one application will take the charge in changing, blocking, or deleting files and programs without having to first ask/prompt me.
In my opinion this should be a standard to any "protection" application.
Plus... didn't Symantec made nice and admitted they were using rootkits? brrrrr...
And on the third and last thought, I read somewhere someone post: With each virus popping up, the McAfee and Symantec's shares prices are jumping (with joy) as well...
Keep your money for something more useful, efficient or pleasant folks...
Antivirus deletes YOU!!
No, I'm not trolling. Search the discussion forums on their site. (I'd do it but I've not had coffee yet.)
True, they put out an update later that same day but it still ruined my entire day. (Gigabytes of info had been quarantined. I thought my computer had been owned.)
McAfee's complete list of files includes FrameworkService.exe... which is part of the McAfee suite (Enterprise Policy Orchestrator, I believe). I guess they got one thing right when they started detecting their own software as infected!
Thank God I can now rest easy!
[Team Leader]: So Steve is new here so, Bob, why don't you show him a simple virus definition for one of these low-priority viruses?
[Bob]: Sure. This virus is low-threat but can masquarade as numerous file names so why don't you just look for a common pattern and write a REGEXP function?
[Steve]: Sure.
[Bob]: You know how to write regular expressions, right?
[Steve]: Yeah, sure, the one's with the asterisks.
[Bob]: Erm, yeah. I'll leave you to it. Just send it to the database so it can get filed in the next update.
[Steve]: OK, see you later.
*Looks around nervously. Briefly glances at long list of file names then timidly enters:*
*.EXE
Add TcL, OpenGL, Xwin and Xterm, plus most Cygwin files, that McAfee seems to hate. Only solution I have found if you are using McAfee 7.1 enterprise is windows system restore.
Ugh... you could stand using WinME? At least XP has some decent wireless settings options, and you can kill a lot of services to make it run about as fast as 2000 in about as much RAM.
My blog. Good stuff (when I remember to update it). Read it.
I just checked the server, all .xls are where they belong.... I manage the ePO... server13 too in case anyone is curious. It's an inherited POC. Nuff said.
Sig Hansen?
If you will read the bottom of the linked article for "fixing" the problem you will find. . . that this also affect linux machines running this crap!
My favorite was a few years ago it was getting a false positive on the program I was working on. It deleted the .exe right after it linked. It was very annoying.
The obscure we see eventually. The completely obvious, it seems, takes longer. - Edward R. Murrow
We've got McAfee where we work, and we found that it was quarantining every file opened on the system for the most part. All kinds of .cs and .aspx files were disappearing. Finally found them in the quarantine after wondering if we had gone insane.
My concern about "uppity" perspectives was directed in general at the idea that some software or methodologies are immune, which many people in this thread have implead.
AVG is superior because it detects infected files and removes them, and is simple to set up, update, and remove. Have you used the latest McAfee offerings for personal computers? Serious pain in the butt, especially if you "upgrade" or start with their on-line version.
Yes, we've evaluated many, and chose (and have used worldwide for several years) McAfee's enterprise-directed "Managed" tools. It's certainly better than McAfee's free-with-PC or cheap-in-a-box versions. (In fact, we advise clients to ignore whatever comes free, and use this. We (a network of IT professional volunteers) picked this to take care of NGO leaders internationally, who are typically clueless about viruses and such. Yet, it serves very nicely for many other environments.
Actually, it's much nicer than anything else we've seen, including AVG and several others. ~Zero or one-click install (zero=push), outsourced policy-based admin (no server s/w to learn/install/maintain), auto-updates, auto-configures on LAN for efficient bandwidth use, one-click enterprisewide summary (no config needed), incorporates anti-malware, blah blah blah.
The only reason McAfee has such a large customer base is...not because they keep computers safer from viruses than their competitors.
In our experience (with the managed solution), ease of install/use/management translates in practical terms to safer computers: we've seen (real-world results) that many admins never bother to fully configure competitive AV management systems, and thus their users can be left on their own.
If we assume (BIG assumption I know) that most Good AV systems will protect from viruses when properly set up and used, then the difference comes down to how well they are implemented and maintained in the real world. That's where we see huge variation among vendors... ease of install/use/admin, support availability (guess which major vendor's "phone support" is only available if you speak Czech!), etc.
My bottom line: AV and AM (AntiMalware) are more important than many people think. If you have lots of time, and are careful, free (i.e. not updated) tools can be helpful. But most people need a paid service, that reliably stays up to date, and that (in practical terms) can and will be fully implemented and properly monitored.
I'd say proprietary software, regardless of its ostensible purpose, "is just another backdoor for anything, be it an attacker or virus, to use to compromise your system/network". No matter how expert you are, you might never know what it does because you are not allowed to learn more. Proprietary programs can do plenty of things you don't want them to do and those bad things can happen without you knowing about the bad things they do. You're denied any opportunity to learn what proprietary software does, to change the program to do something better, or to help others by sharing the improved program with your community. This occurs regardless of how one acquires the proprietary software.
/. thread have suggested) is no solution because that is just switching from one master to another. What's needed is freedom.
I disagree with blaming the victim for not knowing how their computer works--nobody is "asking" or "begging" for trouble. Users shouldn't have to know what's going on in a technical sense if they don't want to know, even though there are horrible consequences of not knowing (ignorance is never advisable, but people should be free to make that choice). Forbidding people any opportunity to know more is anti-social; it holds people helpless to help themselves or others and leaves them dependant on a master who doesn't have their best interests in mind. Switching to another proprietor (as some in this
Digital Citizen
There was a Dilbert cartoon that closely models this.
Dilbert - We can't ship this new backup program, it has too many bugs.
Marketing - What bugs?
Dilbert - It deletes all of your files. If you are on a network it deletes all of the files on the other networked computers. If you have a sound card it curses at you.
Marketing - We will call it Quick Protect and fix the bugs in an upgrade called Quick Protect Pro.
oofs available for checksums...
Think about the potential here... verrrrrry interesting indeed.
Market down insignificatly
MFE down less than 1%
SYMC down less than 1%
Yeah - this looks like a fatal blow to McAfee. This will set them back almost as much as Trend Micro's screwup last year.
So what were you expecting ?
I have mod points and I am not afraid to use them
Users who configured McAfee to delete files are left with using backups
I hope anyone who sets up their virus scanner to delete files automatically really trusts their antivirus program. In this case, it looks like that trust was misplaced.
I have never let any program with an option to delete my files without asking me do so.
http://www.kaspersky.com/ Not only does it have a small footprint in memory, it's been very effective for me. The Malware dictionary is also an interesting read. [I'm not paid for this endorsement.]
I moved to Avast! at home. It's free for non-commercial use and was named the best Anti-Virus on the market by SC Magazine. All that marketing jazz aside... I like the program quite a bit, as it also adds a simple-to-use interface for recovering from problems. Trend Micro has slightly faster response times to viruses in the wild, but Avast is darn close... much better than McAf.
It's interesting how the analogy between malware and lifeforms continues to expand.
Viruses are aptly named because they have many similarities to biological viruses. Anti-virus software is a close analogy to an reactive immune system (such as is found in mammals but not, say, sharks).
Now we have an example of a serious auto-immune disease from a self-attacking malfunction of a reactive immune system.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
But at work, I've changed my mind. I got tired of having to repair several/dozens of machines every time somebody across the vpn plugged in an infected laptop.
Now I've got everything updating off WSUS, network usage for updates is 1/100th what it used to be, and after I approve an update (I get emailed when one needs approval) it automatically gets installed on all the machines, whether or not they're on or there.
I highly suggest it for anyone with more than say 3 similar winboxes.
Autoupdate doesn't have to mean "no human interaction."
Man, you really need that seminar!
Is this a bug or an autoimmunity problem?
Since there's some similarity between this event and autoimmunity problems, there's an easy step from here to trying to trigger autoimmune attacks of the antivirus with the appropriate virus tags.
Does an antivirus only use a database of bad things to recognize, or does it also have a database of 'false positives' to ignore?
It is obviously a clever plot to destroyed pirated software by forcing people to go back to registered original installs.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
huh... funny. i remember using symantec's "pc tools" package before they acquired norton... and while it was totally insecure (running on win3.1) it was a nice little package, with multiple desktops and all sorts of other useful enhancements (like nesting folders on the desktop).
yes. McAfee anti virus scraped off BF2 like it was Zotob.
That's what you get for not testing the software. Shame on you McAfee.
There are two core modules to any antivirus - the standalone scanner, and the realtime protector, which hooks into the OS I/O processes. It is ALL that is needed, 99.99% of the time.
.RAR files as viruses), it's minimalistic realtime protector module is incapable of doing anything but its most basic, required function - DENYING ACCESS.
That's why, although these false alarms may happen from time to time, the chance of damage being caused is much lower with an antivirus which is not too artsy-fartsy for its own good.
In the past 10 years, most antiviruses, with a few exceptions, have been greatly bloated and overhyped. We've been lead to believe that the new and exciting features they offer are actually an improvement. A lot of the time, they're simply redundant.
For instance, the much-touted Email/IM protection modules are not much more than memory hogs. Their sole existence is for the purpose of identifying the source of infection more accurately - but the infected file would've been stopped before execution either way. Any UU/MIME encoded attachment you receive in your Email has to be written to disk first before being executed. Same goes for receiving files via IM.
The realtime i/o interceptor is the one which is going to catch them anyway !
My philosophy is, antiviruses must be kept as simple as possible. So far I've been using one antivirus for 3 years now which manages to stay tight and focused on what it does (coughfprotcough).
Even though this antivirus actually had an incident similar to McAfee (mistaken identification of
I saw this on a friends computer, many executables for Office, and one for VLC pleyer and other stuff like that.
.exe was deleted... hehe.
I only wish Mcaffe's
Not that I'm defending Trend, but there's a heck of a big difference between chewing up all of your CPU (Trend, last year) and removing executables from your machine (McAfee).
Either way, it's a tough problem to solve. As Zero-Day vulnerabilities become more common, the AV publishers are under more pressure to get a new defintion file out the door. About the only timeline you can squeeze there is pattern testing. The FOSS AVs suffer the same fate, it just hasn't bit them on the ass (yet).
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Interestingly, Sophos recently had a similar issue. An update to its antivirus software caused Mac OS X computers to delete system files or move them to a quarantine folder. And the best part? The "infection" that this update was supposed to prevent was a proof-of-concept that is not even in the wild.
http://www.sophos.com/pressoffice/news/articles/20 06/02/inqtanafix.html
One would think that all vendors would take note of competitors' mistakes and carefully test updates before publicly deploying them, if for no other reason than to maintain their reputation. What good is anti-virus software that does more damage than it prevents?
the JoshMeister on Security
Well, apparently the fact that they are not executable has not prevented that damage was incurred by releasing them without sufficient QA.
Repeat after me: I will not release untested software, be it an executable, data, a bit string, or any string of symbols whatsoever.
I had awful bad experince with Mcafee years ago and they are SO EVIL!!! NEVER touch Mcafee... I would never use or test Macfee ever again. They will be sued by many people and will pay!!! this is proof that Mcafee is still evil anyway.
Looks like McAfee listened to complaints, and decided to get rid of rootkits even if they were issued by major corporations.
Either that, or they made one dilly of a mistake.
I think we've pushed this "anyone can grow up to be president" thing too far.
Can you imagine the lawsuits?
They're gone.
This may be a wakeup call for software quality assurance.
I mean, this indicates that McAfee simply IS NOT testing its updates on real live machines with a variety of software. I mean, delete MICROSOFT OFFICE FILES? C'mon, that PROVES these idiots aren't testing anything.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
"Do you see any tigers?"
"No..."
"See, it works!"
I'm not slamming seat belts here - I buckle up before any time I put my car in gear - I'm slamming your strangely peculiar analogy. It seems it's a comparison between a) A simple item one can touch, see and understand how works at first sight, and B) Something you can't see (except for pretty pictures in your tray and annoying-as-hell things popping up on your screen), of which you have no conception of the internals, and made by some people you've never at all met.
Which analogy is better? The Simpsons one, or the parent's?
AVG is not safe. Updates reset AVG's file permissions to EVERYONE when they should be set to Administrator. This problem was posted on dslreports.com a few days ago and hasn't been fixed yet. You can use AccessEnum from sysinternals to see for yourself. If you change the permissions to Admin they are reset to everyone on the next update
A note of interest: lost in the noise by many people in this forum is the report (in the mainstream media) that only manual (on-demand) scans resulted in any problem at all.
;)
The vast majority of users today depend on automated scanning of files as they are used. Automated scans had no trouble.
One of those cases where what would normally be thought of as an extra-cautious approach actually caused extra-trouble.
I've got no inside knowledge, but would guess that the automated scanning path is tested far more carefully (since it has larger implications for potential harm).
Is this an argument for staying close to the mainstream, due to the higher QA bar applied to majority users? Interesting that this brings potential pressure on moving away from a slow-but-careful approach and toward a fast-automated approach. An AntiVirus version of "Real Programmers write in Assembler? Hahahahahaha!!!"
This is incredibly irresponsible on McAfee's part and if I were an IT manager I'd look at alternatives immediately. I haven't liked McAfee for years. I'm starting to hate Symantec, as well. eTrust is probably OK, as is Trend Micro. But some of the most innovative stuff I've seen lately comes from products like NOD32, Norman, F-Prot, AntiVir and Grisoft - companies that don't get to rely on the inertia of gigantic corporate service contracts to stay afloat. They actually have to produce a good product that people want to buy!
if end user pirates mcafee they get sued so i guess mcafee should be paying up big time, get locked up etc :)
for deleting vast amount of user data in fact for commiting "cyber terrorism" huh, shock, gasp.
shut em down ! .
who says its a mistake maybe its a trial run
You can still get Norton AntiVirus (and a dozen other programs) for the Mac, OS X.
Buy a nice little Mac Mini Dual-Core, MS Office, and Norton and don't worry about what people do to FUBAR Windows PCs anymore...just configure your firewall correctly and be careful what you install, download or open.
Macs are not perfect, but they seem to handle errors better, and are little more virus proof...
Mac Mini Dual Core
Anyone remember when you could submit virus definitions to McAfee and they were immediately added to the next definition file download? Then someone used that to distribute a virus. There's a reason I boycott these guys.
If anyone remembers, or has a link to the incident I'm thinking of, please post it. The details are a bit fuzzy in my mind, so corrections are welcome too.
And, I'm not usually one to be this petty, but I'll make an exception in this case, to everyone who said McAfee was a good idea, in spite of my recommendations:
I TOLD YOU SO!!!
Ok, I feel better now.
--Not to be worried, Pitr fix.
My wife's company uses McAfee products. I told her about McAfee's blunder, causing computers to crash.
She didn't She said, "But my computer crashes every day, anyway."
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
(1) do keep it updated
(2) use a firewall for my ADSL
(3) don't use Explorer or any email program, in fact I try to disable as much of these as sensible
(4) don't download and try cuwl new apps
(5) use Windows only for games (and don't do online gaming)
(6) do _all_ my other and online stuff on Linux
In all, I feel that the number of attack vectors is minimized, here. And so I feel reasonable safe when being on the Windows desktop. And I have never seen a MS computer of mine infected since I started using MS-DOS 6.0 in 1992.
But obviously, such a setup is useless when you want to use Windows for anything else then gaming, but why would you want to do that?
I do see an enormous amount of malware coming in on email under Linux, however. And I would install an anti-virus app whenever I would be forced to use email under Windows. *shudder*
Ok, "I know you don't anti-virus because..." jokes, cue... now.
Sorry...
Macs are not perfect, but they seem to handle errors better,
Getting something like "Errror -32" instead of "Invalid page fault" is better?
and are little more virus proof...
Until they gain a respectable market share.