Slashdot Mirror
McAfee Kills SVCHost.exe, Sets Off Reboot Loops For Win XP, Win 2000
Kohenkatz writes "A McAfee Update today (DAT 5958) incorrectly identifies svchost.exe, a critical Windows executable, as a virus and tries to remove it, causing endless reboot loops."
Reader jswackh adds this terse description: "So far the fixes are sneakernet only. An IT person will have to touch all affected PCs. Reports say that it quarantines SVCHOST. [Affected computers] have no network access, and missing are taskbar/icons/etc. Basically non-functioning. Windows 7 seems to be unaffected."
Updated 20100421 20:08 GMT by timothy: An anonymous reader points out this easy-to-follow fix for the McAfee flub.
When your Anti-Virus software bombs you out.
It seems to be very willing to take the whole machine down. Speaking of which, did anyone at McAfee even bother to test this dat on a Windows XP machine?
For those who seek perfection there can be no rest on this side of the grave.
I work at a university where we use McAfee anti-virus as our corporate AV. Guess what I've been doing all morning?
This space for rent...
We've known for a long time but it's good that McAffee finally admitted it.
I would have gotten first post, but I was running windows with McAfee
Well, with McAfee, the cure has been worse than the disease for over a decade now. But the cure is easier to explain to management.
I have seen the future, and it is inconvenient.
True, but business needs dictate software requirements. So that decision is out of my hands (but believe me, I'd LOVE to run an office full of Linux computers)...
If a man isn't willing to take some risk for his opinions, either his opinions are no good or he's no good
Or you can go back to pencil and paper. Much more cost effective than Linux.
at a command prompt when the "windows will shut down in XX seconds" popup us on screen saved me. I'm still waiting for a mcafee update file to fix it properly.
Nullius in verba
Next they will be deleting a directory known to be full of malware called system32
Seven puppies were harmed during the making of this post.
My big question is why is Norton and McAfee still so popular in the corporate world?
I understand that the OEM's preload McAfee or Norton because they are paid to, but the corporate world is paying big money for these out-dated anti-virus programs.
There are much better anti-virus providers out there such as Avast, Kaspersky, Nod32 and others.
Don't know something? Look it up. Still don't know? Then ask.
My God! How can something like this possibly get by QA as a company the size of McAfee? Have they outsourced all of their QA to a team with no clue?
-Todd
Omne ignotum pro magnifico.
Two weeks ago it went and deleted two important for dev c++ and another program at my work. It was insistent they were viruses. I'm not sure how I could have received a virus since I get virtually no attachments and don't email anyone outside of work (ie no "fun" emails), I only visit the BBC, Netbean.org, Eclipse.org and a handful of other reputable sites because I rather goof off by writing my own code than doing nothing and I scan all my downloads before installing them.
Sure maybe I got unlucky for the first time in like 3 years. Maybe someone used my computer while I was on holiday but I suspect not. I suspect it's related to this.
Seriously. They consume CPU. They stay resident and consume usable memory. They occasionally crash and/or cause other applications not to work. And, in this situation, they break Windows. I don't use AV and have had pretty much zero issues over the last 6 years of using Windows XP. All you need to do is:
* Configure Windows update to run daily.
* Don't use IE or Outlook.
* Keep Windows Firewall active.
* Don't connect directly to the internet- sit behind a router that's configured to be (mostly) invisible.
* Don't run random things you get sent in email, on facebook, or that pop up unexpectedly while you're at a questionable website.
* If you think something's amiss, boot into safe mode and use a non-resident tool like MBAM.
Basically it looks like command line
shutdown -a (to stop the autorestart)
Put SVChost.exe back in place (out of the quarantine )
and disable McAfee...
DJMD - The fourth man - Planetary
I work at a major chip manufacturing plant. At 4.10 I was conferencing with another fab when all our PCs shutdown. 10 minutes later the place was in chaos. Now don't get me wrong the fab keeps going but my god the cost to the company of this. Say 10 sites world wide with 2-5k employees each the majority of which can't do any meaningful work. McAfee have a lot to answer for.
A quick google on the subject brings up many other testing that ranks norton below the ones I mentioned.
So it would all boil down to whom you believe, who is the least beholden to their advertisers?
And Norton and McAfe spend TONS on advertising.
Don't know something? Look it up. Still don't know? Then ask.
I agree that it raises question as to why one should use them, but "down time" is not the biggest threat out there, if you wanna talk loss/cost. While one's time is valuable, I'm thinking that their bank account information, passwords, etc, might be slightly more valuable to them. Personally, I think good secure end-user practices is the best protection, I do think that a good A/V program is needed.
So, while there is malware out there that is less harmful, more of the malware out there is much MORE harmful... if you disagree, please provide your financial account information, or contact me to transfer all funds to a secured off-shore account... maybe buy me a new car too! ;-)
But seriously... this is really bad, and REALLY stupid. But having no protection for most users risks damaging them in ways worse than a few hours of time to manually fix their issue. And from a corporate perspective, loss of sensitive information is a BIG deal and can cost a LOT more. And that's just talking about data loss. Being part of a botnet to help facilitate financial fraud and other badness... that's also double plus ungood... and irresponsible to not take measures to help keep your computer from playing a part in those crimes.
Anyway... I agree it raises question... but there more downside to malware than just downtime.
What I want to know is how does something like this happen? You would think McAfee takes their new patch and tests it to make sure that it doesn't cause this type of annoying issue. How does something like this slip through the cracks?
Norton, McAfee and Trend Micro have very solid products that allow for remote management, deployment, updates, forced scans, etc.
Avast (which I use at home) does not have all of these features yet. I can tell you that when dealing with hundreds of machines, having that dashboard for antivirus saves many hours of time. You can run more frequent scans on problem machines, or allow more/less freedom with the click of a button. Many of the products also have URL blocking (by category), email attachment filtering through Exchange plugins, etc. One feature I like about Trend Micro is the "behaviour" plugin, which flags anything out of the ordinary - such as accessing files, programs, or drives that they haven't before.
Corporate networks also typically have edge firewalls that will catch many of the malware infested URLs, email attachments, etc that cause problems. For many businesses 200+ computers, the Windows-installed Anti-virus software is actually the last line of defense. Often times the loss of productivity of a couple viruses getting through isn't worth the extra $$ invested in more products or a "better" product with less management features.
Licencing is also a plus. While Norton, McAfeee and Trend Micro are expensive initially, additional licences for a large number of computers and renewal licences each year actually make it less expensive than others such as Avast and Panda.
We have hundreds of systems down. We were looking at Avira in any event as it was lighter, but now we are moving there at warp speed. Mcaffee's quality assurance really screwed up on this. Major problems worldwide.
Subject line says it all...
retrorocket.o not found, launch anyway?
because it comes pre-bundled into every machine from just about every major vendor, and people are too lazy and stupid to find/get something better
"I disapprove of what you say, but I will defend to the death your right to say it." - Evelyn Beatrice Hall, re Voltaire
Good thing I switched to Norton!
I've never liked SVCHOST.EXE anyhow. I'm glad it deletes it.
The story just hit ABC News, via the Associated Press: "McAfee Antivirus Program Goes Berserk, Reboots PCs" There are stories on the Huffington Post and NextGov. The story just broke into mainstream news in the last hour. It just hit the New York Times.
There's nothing on McAfee's home page about this yet. No items in their "News" or "Threat Center" or "Breaking Advisory" sections. There's supposedly a McAfee Knowledge Base article, "False positive detection of w32/wecorl.a in 5958 DAT", but their knowledge base site is overloaded. When it eventually loads, there's a download link to a patch. But there's nothing like an apology. All they say is "Problem: Blue screen or DCOM error, followed by shutdown messages after updating to the 5958 DAT on April 21, 2010."
McAfee has botched their damage control. They should be out there apologizing. Meanwhile, you can watch McAfee stock drop.
Comcast decided to start providing Norton instead of Mcafee to its customers.
After years of not using a signature, I am going to make one to say the following: Fuck Beta
There is a lot of business software that runs only on windows so the whole "just switch to linux" thing is quite impossible in many cases. Of course the problem here isn't windows, it's McAfee, but don't let that stop you from pretending that linux is superior to windows in every way.
The needs of the business dictates what O/S is used. Sometimes linux is best, sometimes windows is. If I acted like a fanboy and let my personal bias overrun the needs of the company then I wouldn't have a job for very long, and neither would a lot of other people in I.T.
In my case it's pretty easy though. The software doesn't exist for linux that could fill our business needs so switching from windows to linux would be a horrible choice, ruin the company, and put a lot of people out of work.
Remember, dreaming is free...until you forget your dreaming.
I have to wonder what controls the various AV companies have to prevent a malicious signature be inserted - for example, someone deliberately doing something like this (but hitting all versions of Windows).
It's not just McAfee that's had this particular style of false-positive problem - Symantec also falsely identified a legitimate part of the Windows 2003 Server resource kit as malware. Fortunately in Symantec's case the damage was very limited.
Oolite: Elite-like game. For Mac, Linux and Windows
By God, you're right!
Your wise advice has galvanized me to action!
I am switching the entire company over to Linux this very instant.
Just as soon as I find the AutoCAD for Linux install CDs.
None of them can see the clouds; The polished wings don't care.
It's days like this that make me glad I set our ePO server to wait a day to distribute new DATs. I've been considering an AV change, this seals it!
Don't be a typical smug IT guy. You really think the average consumer is going to go buy a PC and think, "Hey, let me research this anti-virus thing. I think McAfee might suck." No. Why would they do that? Isn't that why they are coughing up the big bucks to begin with, so that they don't have to? Weather or not they have valid reason to worry is beside the point. Don't call them stupid though. I can't stand the stigma attached to IT guys, but alot of the times the stigmas are valid.
ClamWin *itself* doesn't have an on-access scanner but...
On the other hand, there are numerous plugins to hook clamwin to, so you can check for virus at their point of arrival.
(On the client's side there are Firefox and Outlook plugins, on the server's side there are Samba plugins)
but personally I supplement always ClamWin with a 2nd antivirus featuring a on-demand scanner.
ClamWin&Plugins +Avira or +AVG.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Computerworld reports that McAfee has reacted to user complaints by shutting down their support forum. The forum seems to be back up now. That was an extremely dumb move to pull after the story was already in the New York Times, Business Week, and on TV.
Many frantic users in the forum. The big losers are the enterprise users who bought into McAfee's premium services, with automatic corporate-wide updating. There's no fully automatic, reliable fix yet for systems already damaged. In some cases, it's apparently necessary to bring in a new copy of "svchost.exe"; the one in quarantine is bad.
This points up a major risk to US computer infrastructure. Any program with remote update is potentially capable of taking down vast numbers of systems. Ones like McAfee or Windows Update, which deploy updates to all targets simultaneously, can cause widespread damage quickly. Remote updating by vendors may need to be regulated, as a public policy issue.
We've used Mcafee for years. It can take a brand new quad core computer with 4 gigs of ram and make it operate at half its specs. It's garbage. I've used a few antivirus products over the years and all its enterprise features have never worked properly. It's purely marketing and sending PHB's free swag. There are a lot of anti virus companies with the features you mentioned that do it far better than Mcafee. The only reason they are still in business is because of marketing.
If an officer ever threatens to taze you, say you have a pacemaker.