No senseless quotes here
|
|
|
McAfee update kills Windows XP systems
INSECURITY VENDOR McAfee has admitted that a recent antivirus update is rendering PCs inoperable.
The update, 5958 DAT, was released by the firm early on Wednesday and it didn't take long for reports to surface that users were experiencing blue screens of death (BSoDs) and DCOM errors shortly after applying the update. The update seems to affect Windows XP SP3 users, with the post update security scan recording false positives, misdiagnosing machines as infected with W32/wecorl.a malware.
Since then the company has been in damage control mode with its executive vice president, Barry McPherson attempting to quell the flames by saying that the problem has affected only "less than one half of one percent" of the firm's enterprise customers and even fewer consumers. That might be so, but given that large firms typically deploy the same security software throughout their inventories, a single "account" can represent hundreds or even thousands of now useless computers.
McPherson's first post generated replies from irate customers, including one asking for the company to come clean about the problem, saying, "Why not just admit the f'up and say you're sorry? You jacked up untold hundreds of thousands if not millions of computers." Another customer whose firm apparently spends $9,000 per year on McAfee products said, "I've been asked by upper-management to look at other products and another email-filtering service." Similar sentiments are repeated many times, with users saying that they have lost money trying to fix McAfee's mistake.
Later on Wednesday McPherson reacted to those posts, claiming that after working 14 hours straight, he takes the comments on his blog "very seriously". Presumably it's hard to ignore when you have a number of loyal customers threatening to take their business elsewhere. Various quick fixes have been suggested, including replacing the svchost.exe from a working Windows XP machine. However a reader points out that after the firm's software deletes the svchost.exe on the affected machine you can't even copy and paste the replacement svchost executable. Unsurprisingly the frustrated and angry user called the fix "BS" after saying that the problem cost "hundreds of man hours".
McPherson claims that he has been talking to "hundreds of colleagues" and emailing thousands in order to find the best way to fix these issues. He also admits that Wednesday 21 April was not his or McAfee's "favourite day". We think McPherson will find that many of his customers share that sentiment, given that his firm disabled their primary means of making a living, with one comment urging that McPherson have "red hot pokers plunged into his eye sockets".
The update has since been pulled from the firm's servers, though that will be of little consolation to those who have had to spend time and money fixing their machines.
This unmitigated disaster for McAfee goes to highlight that insecurity firms can compete, effectively, with the malware authors when it comes to bringing down PCs. The difference being that, unlike malware, you have to pay for McAfee's products. µ
Share this:
Share
It's all very well for McAfee to talk about issuing software to fix their F*** up, but that depends on customers having a working computer. As this thing completely killed mine.. no dll files, no printer, no internet, unable to open their own security centre... to name but a few. So just how are they going to compensate me for the £400 I have had to spend on a new laptop as I needed one urgently for my work? If they think I'm going to risk downloading any of their products onto the new one they've got another thing coming.
"Instead of demonizing McAfee, I think that people could perhaps look at the "bigger picture" -- namely their own "wisdom" in choosing to run a high-maintenance operating system which can apparently never be made secure or dependable." .... posted by : Thin Client, 23 April 2010
Err ..... Was not the original sin and prime fault not the selling the operating system and all dependent and attendant applications [bells and whistles/baubles and beads] to ignorant and beguiled consumerists aka sucker consumers, for the milking and electronic transfer of their cash.
I don't get what all the fuss is about. For years Microsoft and a huge army of security/anti-virus companies have been striving to render Windows secure.
Finally McAfee's "advanced automatic security hazard scanning system" happens upon the winning formula to remove the root cause of the problem. Disabling network access (and PC access for good measure in many cases) is really the only way to remove the threat of Internet-fuelled hackers and trojans to a system which never was designed to be secure AND networked in the first place.
Instead of demonizing McAfee, I think that people could perhaps look at the "bigger picture" -- namely their own "wisdom" in choosing to run a high-maintenance operating system which can apparently never be made secure or dependable.
"This unmitigated disaster for McAfee goes to highlight that insecurity firms can compete, effectively, with the malware authors when it comes to bringing down PCs. The difference being that, unlike malware, you have to pay for McAfee's products. "
One imagines that McAfee can be sued for punitive compensation?
Our company in the Philippines was hit by this, we have around a few hundred PCs in our office and about 10-15% of those PCs were rebooting every 15 mins. We are working as a support for various offshore clients and we were bombarded with tons of emails from irate and angry clients. What can we do if our own PCs were also rebooting every 15 mins? Some desperately tried to "fix" their PCs and eventually f'ed up their PCs requiring a clean installation.
Good job mcafee, countless companies lost thousands, even millions of dollars worth of income because of this, expect your company to lose even more.
Is this McAfee update problem only just occurring recently (XP operating system). I'm only a single user in the UK, using the McAfee anti-virus system via a third party broadband provider (BT). I experienced a similar problem back in March (PC continuously boot-looping). I was told by a local PC shop that it was caused through a McAfee update. Is this same problem or a new one - I would be interested to know?
I've solved the problem for the time being by buying a new PC with Windows 7. However, I would like to get my Old PC working again so that I can get some of the stuff of it which I need for my college work.
What should I do now? Now I have to cram.... MCAFEE WHAT NOW!!!!!!!!!!!
I can only imagine that the claim that consumers weren't affected much is because most of them weren't at home logged in at that hour. There has to be A LOT of consumers running WinXP SP3 still.
I lost a bunch of time yesterday to this AV feature. The fix was easy enough, but I couldn't address it until late at night which cut into my sleep. That's a big no-no. I for one am glad my subscription expires next month.
I did a virus scan, it says it found an infection (I think in svchost) then it says its shutting my computer down in 40 seconds.
When my computer comes up again svchost.exe isnt there in windows\system32. Also I have lost the ability to search files, paste anything (files, text, images etc), my sound is gone and skype is complaining about an oleexception rpc something.
Also although I have my desktop background, it takes ages for the icons to turn up, and I have lost my taskbar!
Also Mcafee would not start up (well it had the sheild in the task bar but could not right click or double click it.) (But I had the internet!)
It took me 4 hours to copy an old svchost from a different computer (using Knoppix live (linux computer recovery disk)and the memory card on a digital camera)(Cds wouldnt work because no copy paste and couldnt find a mem stick) and that didnt really fix anything (well my taskbar turned back to blue from grey).
Tried downloading another anti virus prog but it stalled on "click yes to accept"! Mcafee free scan didnt like my browser, and didnt work in explorer either!
Deleted ProgramFiles\mcafee\virusscan\DAT folder and manually copied over svchost from dllcache back as mcafee suggested.
That didnt work. Still all the same problems.
Found mcafee fix (sdat5958_em.exe) ran in safe mode as admin but wouldnt install, crashed on or just after trying to copy copyfile.exe , because couldnt copy file.
Booted into normal windows, still broken.
Deleted svchost.exe from windows\system32 again in knoppix. In windows safe mode ran sdat5958_em.exe again , but it still crashed. So I copied svchost back again from system32\dllcache again.
At this point I was so desperate I thought of contacting mcafee support!.
But then I rebooted into windows and everything started working again. Still dont know what the heck I did different !
Just had to download mcafee virus update and all back to normal !
I recon most people dont know its a problem with a mcafee update, and think its just a really really bad virus.
I work for an international company with close to 100,000 worldwide employees. We use McAfee and their auto security updates. Since we never went to Vista & are just now going to Windows 7, probably 25%-30% of all our PCs were taken down by this. This update was released about 6am. Anyone who turned on their PC at work in the morning before this problem was discovered would have gotten hit. If this had been released later in the morning when the majority of our PCs would have been online, we probably would have had over 80% of our PCs down.
For anyone still needing a fix...this link is useful
http://isc.sans.org/diary.html?storyid=8656
Let me outline McCrappys troubleshooting support and this includes you having a TAM and paying significantly more than a mere $9,000. Been through this in two Dow 10 organizations.
Step 1. Deny - TAM response. Your the only client experiencing this issue. Meanwhile we were in communication with a major airline who also was going through the same issue. Tip to McCrappy - Technical people know one another and talk to each other.
Step 2. Delay - Our people are looking into your issue. No they are not the TAM's job here is to delay until the next virus definition which hopefully doesn't produce the same result.
Step 3. Acknowledge - The next virus definition/engine update still contains the bug. An engineer is finally going to look at the issue they created.
Step 4. Finally admit to the issue and resolve the issue they created but wouldn't acknowledge.
Rinse and repeat as the same problem will return in 1-3 months.
Its better than Symantec which destroys your PC or sharepoint on uninstall.
Less than one half a percent? What a joke. It completely wiped out systems at work with staff unable to login to their machine if they locked their PC overnight. We lost productivity and suffered a great inconvenience today. And before you assume I work with less than a dozen people at last count there were nearly 7,000 affected users. Very disappointing, not the first time that VSE has stuffed up and certainly not the last.
I really do hate the way they play down incidents. Own up, apologise, and move on. Without the spin.