Kaspersky Update Breaks Internet Access For Windows XP Users

An anonymous reader writes "Yesterday afternoon, Kaspersky Labs released a definition update that blocked all Internet and Intranet access on Windows XP workstations. While there has been no official communication from Kaspersky, their forum is lit up with angry customers relying on each other to find a fix." Update: 02/05 16:42 GMT by T : Thanks to an anonymous reader, who says that Kaspersky has issued a statement, and a fix (though the fix takes some manual labor to implement).

Comments

let me guess

[Anonymous Coward]

they already have a fix you can download!

Quality Control 101

[DigiShaman]

Epic FAIL! All you AV providers need to be testing your damn defs before deployment to the public. Geez, how fucking hard is this?

Re:Quality Control 101

[SJHillman]

That covers the hardware, which is mostly irrelevant to anti-virus other than how long it takes to scan. What service pack is installed? What patches? Hotfixes? Third party programs? What malware is on there? What files are corrupt? What settings has the user changed? Is it Home or Pro? Once an XP machine has a year or two since the last OS reinstall, there's thousands of variables. Once an XP machine has four or five years with an average user, it's almost unrecognizable.

Re:Quality Control 101

[DarwinSurvivor]

What other AV software is installed. It's not uncommon for people to install 2 or 3 of them and have no idea that they don't play nicely together.

Strong Protection

[stewsters]

Sometimes the only way to win the game is not to play. It seems like Kaspersky has learned that the only way to secure Windows XP is to disable the internet connection. Now if they disable the USB ports next, I think we will have a good security model going. Unfortunately that update will be harder to push.

Isn't that the goal?

[tanveer1979]

To be the perfect AV
No internet means
No virus
No Botnet
No Adware
No Spyware ......

Or maybe the program became self aware and realized that the internet is a disease, a virus, needing to be squashed

Re:Isn't that the goal?

[UnknownSoldier]

You may laugh, but originally that was the only way for Windows NT to get C2 certification. :-)

* http://support.microsoft.com/kb/93362
" Microsoft has opted not to include certain components of Windows NT in the evaluation process, ... It may be enough to consider networking to be another subsystem, ... "

Actually, they don't.

[mschaffer]

Right now, the "temporary" fix is to disable their Web AV.

Re:Actually, they don't.

[oobayly]

At least you can do that. I had a mate that installed McAffee (because it came bundled with BT's broadband package). His machine refused to connect to the internet, though ICMP packets were allowed. My first thought was "Disable everything that even resembles McAffee", but to no avail. In the end I did what I should have done initially - wipe every mention of McAffee from the machine - job done. I still don't know what was blocking the traffic.

Link to fix

[davidwr]

http://forum.kaspersky.com/index.php?showtopic=255508&st=20&p=1978848&#entry1978848

Text of fix, credit the forum poster known as "omaudio":

from Kaspersky-

"We apologize for the inconvenience. It does appear that there was a hiccup with an Update pushed out causing Windows XP machines to lose internet connectivity. An update was just released that should address the issue, what I will need you to do is:

To get XP users internet connectivity (temporarily), please disable the Web AV component of your protection policy for your managed computers. After doing so;

In Security Center (or Admin Kit):

1.) Go to the Repositories section >> (Right click) Updates >> All Tasks >> Clear updates repository.
2.) Go to the Repositories section >> (Right click) Updates >> Download Updates

After taking this step, please run your group Update task for Managed Computers. After the update has been pushed to your workstations, please re-enable your Web AV component in your protection policy. This should resolve the issue. "

Don't worry, they are already working on a fix

[Hentes]

The next update will fix the issue, you'll just have to download it...oh, wait.

Good Guy Kaspersky

[Apotekaren]

Protecting users of more up to date Windows versions from those malware infested botnet-targets.

Re:In Soviet Russia...

[jones_supa]

In Soviet Russia, the viruses scan YOU!

When does AV become more risky than the virus?

[Alioth]

I have to wonder at which point workstation AV software becomes a bigger risk than the actual malware.

So far in our organization, we've had two AV incidents. One several years ago when a user brought in an infected laptop with one of the Microsoft RPC exploiting worms. We got the worm before the AV vendor (Symantec at the time) had a signature for it, so the AV software was totally useless. The other event was when Symantec erroneously flagged a Windows Server 2003 resource kit program as malware and quarantined it (fortunately, a program we didn't rely on). So so far, for us - AV has failed to catch our only malware infection and has broken a non-infected program. Strict filtering (both inbound AND outbound) has done a lot more to stop malware in our organization than AV software ever has.

I also remember an incident a few years ago when a prominent AV vendor's software (I think it was Norton) erroneously quarantined a system file in the Chinese version of WinXP, and rendered the workstation unbootable, affecting a very large number of users.

I also wonder if any of the AV companies have independently verified and verifiable procedures for making their updates; a malicious employee at one of the big AV vendors could cause a lot of damage by releasing an update that results in an important system file getting quarantined. What safeguards do each AV vendor have in place to prevent this happening? How is it verified that the companies are actually carrying out the policies if they have them to ensure updates are not malicious, and how is it verified that these policies are actually watertight?

"There has been no official communication..."

[hobarrera]

there has been no official communication from Kaspersky

It seems they were using Windows XP.

Re:people still use windows xp?

[Gaygirlie]

everyone that i know uses windows 8 on intel i7 or Amd FX computers.

So, you don't know anyone besides yourself?

It's not just with WinXP.

[andywest]

This is not Kaspersky's only problem with its anti-virus product. I have been asked to install a 'technical update'. When I did so, it crashed the anti-virus so badly that it no longer worked at all. I had to physically remove its folder from the Program Files area and reinstall the program from scratch. And this was with Windows 7. That was back in November. When I got the same message in January, I thought Kaspersky might have fixed the problem. Nope: Install -- crash -- scrape up mess -- reinstall from scratch. You kind of wonder what has Kaspersky been doing over the past six months.

Re:It's not just with WinXP.

[WhatAreYouDoingHere]

I had to physically remove its folder from the Program Files area...

I just got this mental picture of someone opening up their hard drive and scraping a section off one of the platters.... :)

Re:people still use windows xp?

[vlm]

LOL the first link I found was a w3schools one where apparently 1/5 of wanna-be web developers were using XP as of two months ago. Its been dropping about 10% per year for several years now, so that will sunset around 2016 or so.

If a fifth of the techno-elite (LOL) are using XP I think in the wider market the numbers must be 50% or so.

I know MANY megacorps still stuck on XP. There are huge issues with being unable to give a "better" computer to a "lower" status employee that really screw up rollouts, not to mention corporate demanding certain software versions and the division demanding certain versions and the local team demanding certain software all adding up to its quite possible an upgrade is impossible until some bean counter 2000 miles away finally stops using some oddball thing. Or more likely they stopped back in '07 but no one has updated the official list since then and lots of CYA about what if they needed to access files using that antique app...

Re:people still use windows xp?

[cusco]

The new security model in Vista/Win7/Server 2008 breaks a lot of software. Lots of it. Tons. Especially building automation, medical equipment, factory automation, robotics, SCADA, pretty much any piece of equipment that needs to work 24x7 for years at at time without upgrades or updates and which costs more than $100,000 is going to run XP until physically replaced.

Place I used to work had a knee-high pile of Compaq 386 laptops sitting in the radio room. I offered to surplus them and the radio guys almost had a heart attack. The company had bought a half million dollar state-of-the-art radio system in the 1990s, and the control software would only run on a 386 running DOS 4. The manufacturer was purchased almost immediately afterwards by another company, which discontinued that hardware and its support. That stack of laptops was their backup for the control program.

There are multi-million dollar CNC lathes that use Windows NT, sawmills which will only run on Win2k, and PET scanners which will never upgrade higher than XP SP2. It's not about "status", it's about having functioning equipment.

Fix is right there on the internet

[Geoffrey.landis]

So, they broke internet access, but it's ok, because you can download the fix from the internet.

That reminds me of the failure of the Russian Phobos-1 mission, which occurred when they sent an (incorrect) command stating, roughly, "point the receiving antenna away from the Earth, and wait for further instructions."

* (greatly simplified)

Re:Anti Virus Software

[futhermocker]

Many wishful thank yous my goodest friend. Kaspersky will soon wire money you earn so well by shill being.

Re:people still use windows xp?

[jawtheshark]

Yes, exactly.... That is what so many people here on slashdot fail to see: it works, it does the job, replacing it costs money and for the majority of people it isn't a high priority thing to do, or even totally necessary. I have one laptop running XP and it works perfectly fine. If you are moderately knowledgable about Windows XP, it is pretty easy to run a Limited User account for day to day operations and only log in as Admin when necessary for maintenance. Making it nearly as secure as Vista/7/8, in some senses more secure, because UAC won't ask you permission. You'll be denied permission and either will have to use the Run-As feature or log in as Admin. I never needed to reinstall that machine, it's still in very good condition (Machine was bought in January 2007)

My only concern is indeed the lack of support, but then, I'm not even all that worried.