Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

McAfee Anti-Virus Causes Widespread File Damage 353

Posted by Roblimo from the who-can-you-trust? dept.
AJ Mexico writes, "[Friday] McAfee released an anti-virus update that contained an anomaly in the DAT file that caused many important files to be deleted from affected systems. At my company, tens of thousands of files were deleted from dozens of servers and around 2000 user machines. Affected applications included MS Office, and products from IBM (Rational), GreenHills, MS Office, Ansys, Adobe, Autocad, Hyperion, Win MPM, MS Shared, MapInfo, Macromedia, MySQL, CA, Cold Fusion, ATI, FTP Voyager, Visual Studio, PTC, ADS, FEMAP, STAT, Rational.Apparently the DAT file targeted mostly, if not exclusively, DLLs and EXE files." An anonymous reader added, "Already, the SANS Internet Storm Center received a number of notes from distressed sysadmins reporting thousands of deleted or quarantined files. McAfee in response released advice to restore the files. Users who configured McAfee to delete files are left with using backups (we all got good backups... or?) or System restore."
This discussion has been archived. No new comments can be posted.

McAfee Anti-Virus Causes Widespread File Damage More

McAfee Anti-Virus Causes Widespread File Damage

Comments Filter:

  • Help! (Score:5, Funny)

    by vjmurphy ( 190266 ) on Monday March 13, 2006 @09:04AM (#14906880) Homepage
    I need virus protection from my virus protection!

    • Re:Help! (Score:5, Funny)

      by spellraiser ( 764337 ) on Monday March 13, 2006 @09:12AM (#14906939) Journal
      Okay - but after you get that, are you still safe?

      NO!

      You're going to need some virus protection from your virus protection from your virus protection to be absolutely safe.

      Thankfully, I am offering those at very reasonable prices. Buy one now and receive a free fragment from the Eiffel tower as a value-added gift.

    • The real irony here.... (Score:5, Insightful)

      by cbiltcliffe ( 186293 ) on Monday March 13, 2006 @09:38AM (#14907166) Homepage Journal
      The real irony is that all the people who are too lazy/stupid/uneducated to update their anti-virus subscription were protected against this.....

    • Re:Help! (Score:5, Informative)

      by xtracto ( 837672 ) on Monday March 13, 2006 @10:00AM (#14907393) Journal
      What about a *nix firewall [muine.org]with antivirus software on it [f-prot.com]?

      You only need that headless pentium 3 (even a pentium pro could make it!) that you are using to rest your feet ;-), plus you will be able to forget the burden of whatever "ANTI-*.* " software that wastes your precious resources.

      Of course that is if you use Windows (for whatever reason, I also do it).

      • Re:Help! (Score:4, Insightful)

        by rikkards ( 98006 ) on Monday March 13, 2006 @11:16AM (#14908115) Journal
        That's great but what if someone introduces a virus through other means i.e usb key, infected laptop, etc. Firewall won't help much internally

        • Solution:PXE boot Linux Thin/Thick Client Desktop. (Score:3, Interesting)

          by NZheretic ( 23872 ) on Monday March 13, 2006 @06:47PM (#14912012) Homepage Journal
          Linux on the Desktop at work and worth it [com.com]:
          Although they have chosen to deploy Linux using the traditional thick desktop/workstation model, they use a spare server that operates as an X11 application server. This is used on a regular basis by the helpdesk, IT support and a few Windows users that access both windows and remote X Linux. The rescue partition, that can be also network booted via PXE, is based on the Linux Terminal Server Project ( http://www.ltsp.org/ [ltsp.org] ). During an install or if a security violation is detected, the user of the desktop is booted into Linux thin client, and can access all their files though the Application server. Forensic examination, repairs and installs can take place in the background while the person uses the thin client.
          The open eleven steps to telecommuting [blogspot.com]
          4) Install a DHCP demon on the local server to allocate local IP addresses, DNS and gateway settings. If the desktops are network boot capable then install TFTP to remotely boot and use Knoppix via PXE and the network [knoppix.net]. If the desktop OS is constantly crashing, or is infected by malware, the user can select PXE/network boot via the BIOS, and boot into Knoppix. The user can then be instructed over the phone to enable the ssh server to allow remote scan,repair and reimaging of the desktop partitions. The user can use the Knoppix desktop to continue working with full access to files while the the remote administrator fixes/reimages the drive in the background.( Consider hiring someone who knows how to customise Knoppix or another live Linux system for your setup )
    • My antivirus ate my homework :(

  • The Risk (Score:5, Insightful)

    by eldavojohn ( 898314 ) * <eldavojohnNO@SPAMgmail.com> on Monday March 13, 2006 @09:04AM (#14906882) Journal
    I think it's funny how on McAfee's site [nai.com], they list the risk of the virus they are trying to identify:
    Corporate User : Low
    Home User : Low
    Did they forget to include that the risk of installing McAfee Anti-Virus for any user : High?

    Wait a minute, it is identifying some system files that Windows put on my machine! I guess the Mac & 'nix freaks are right, Windows really is a virus. I hope it's only a matter of time before my next virus definition assesses Internet Explorer & Windows Media Player as full blown Trojan viruses distributed as malware with my OS.

    • Re:The Risk (Score:5, Insightful)

      by Aspirator ( 862748 ) on Monday March 13, 2006 @09:14AM (#14906956)
      One of the commonly percieved risks of viruses is that
      'they will delete your files'.

      In one fell swoop it seems as though McAfee may have deleted more files
      than all the viruses it has removed would have.

      • Re:The Risk (Score:3, Insightful)

        by Dare nMc ( 468959 ) on Monday March 13, 2006 @09:25AM (#14907054)
        >McAfee may have deleted more files
        than all the viruses it has removed would have.

        go figure, no big system admin has wanted automatic (witout testing) updates for some time, to their OS. I guess sys admins got lazy on testing virus scanner updates before rollouts.

        I know I am not alone in turning off all runtime virus protection on my PC, because it has historically had more impact on system stabilty, and speed than most virii. (ok it seams the latest scanners on winXP may actually work...) Wouldn't save me from this problem, except my system scans only occur weekly, so may be luckly my weekly scan didn't occur (I do have nightly complete backups from backuppc.sourceforge.net [slashdot.org] ).

        • Re:The Risk (Score:4, Insightful)

          by stinky wizzleteats ( 552063 ) on Monday March 13, 2006 @01:24PM (#14909299) Homepage Journal
          I guess sys admins got lazy on testing virus scanner updates before rollouts.

          That's very funny. When a ubervirus thrashes a couple of corporate networks to the tune of a billion dollars apiece, we hear "Stupid admins - the patch was available - they weren't keeping up". Now it's "They should have tested before rolling them out." (paraphrased)

          It appears, therefore, that using a system that is subject to viruses and security vulnerabilities on the scale of Windows is inherently untenable. We can't even define logically consistent expectations for the administrators of such systems. Can we stop using them now?

        • Re:The Risk (Score:4, Interesting)

          by digital photo ( 635872 ) on Monday March 13, 2006 @02:01PM (#14909667) Homepage Journal
          More often than not, the choice to put AV software on systems wasn't a sysadmin choice, but a management/business choice. IE, cost reasons, CYA reasons, lower priority than say getting that next X million dollar project up and running, or some other reason which pre-empts AV stuff.

          I don't use AV software on my systems at home, but that's a personal choice. Not due to laziness, but because other measures have been taken: strong firewalling, restricted software on desktops, strong desktop settings, regular backups, and sufficiently educating anyone who uses the computer of the dangers they can face, what online actions are risky, and to abide by the basic rules so as to avoid putting your data/computer at risk.

          For half a decade, I've gone without AV software and have had all of my systems virii/adware/malware free. This isn't due to laziness, but diligence and preparation. This isn't due to OS fanatacism, but making a decision about what compromises to make between security and usability. I use WinXPpro, Linux, and MacOSX systems at home.

          When people passively rely on external assistance, like AV software, something like this would eventually happen. People make mistakes. Companies make mistakes. And when you have a large install base, those mistakes can easily become big monstrous mistakes.

          Right now, ALOT of sysadmins are probably sweating bullets getting systems back online. This isn't because they were lazy. This was because someone at another company screwed up and it impacted their infrastructure, which in turn impacts their business.

          Make no mistake, people will get sued and lawyers will get involved. Think it was just the businesses and end users of the AV software that got screwed? What about the customers of the businesses? What about the home users who run their business off of their home computers? Yeah, there'll be some noise about this down the road, make no mistake.

          *listens over the cube walls* I don't hear any cursing or screaming, so it hasn't happened here or the OS admins have done their homework over the weekend. In either case, this will be interesting to follow in the months to come.

      • Comical recovery instructions from McAfee (Score:5, Informative)

        by Anonymous Coward on Monday March 13, 2006 @11:19AM (#14908142)
        Even better are McAfee's instructions for how to recover from the damage their product has done. The first option is to restore the files from quarantine, assuming your version of McAfee actually lets you do this (not all, including the corporate version, have this option). The second is to use Windows System Restore.

        This probably would have worked great on my machine if it weren't for the fact that half of the files McAfee quarantined were *System Restore files*.

        Apparently McAfee hasn't heard of a novel concept called "testing". (I like how they've posted a list on their website of the false positive files, now 7 pages long and still woefully incomplete; they ought to just admit it's going to take a random assortment of exes and dlls on any machine.)

        Combine this with the fact that the default settings on a McAfee install are to quarantine without prompting, and IMHO McAfee is the most dangerous virus I've ever had on my machine.

    • Re:The Risk (Score:2)

      by dc29A ( 636871 ) on Monday March 13, 2006 @09:16AM (#14906977)
      Wait a minute, it is identifying some system files that Windows put on my machine! I guess the Mac & 'nix freaks are right, Windows really is a virus. I hope it's only a matter of time before my next virus definition assesses Internet Explorer & Windows Media Player as full blown Trojan viruses distributed as malware with my OS.

      With common sense like not running Windows as root, ditching IE, ditching WMP and not blindly installing every software you find (even if it has flashing (OMG YUR PC IS SLOW GIGGLEHURTZ!!!oneone!!!) you don't need anti-malware on Windows.

    • Re:The Risk (Score:2, Funny)

      by AndroidCat ( 229562 ) on Monday March 13, 2006 @09:18AM (#14906990) Homepage
      Don't worry, just install the new patched version of McAfee. I believe the internal name for this release is called Skynet.

    • Re:The Risk (Score:4, Funny)

      by fuyu-no-neko ( 839858 ) on Monday March 13, 2006 @10:08AM (#14907476)
      I guess the Mac & 'nix freaks are right, Windows really is a virus.

      But aren't viruses meant to be small and efficient? O.o

  • Good thing... (Score:3, Interesting)

    by Anonymous Coward on Monday March 13, 2006 @09:04AM (#14906886)
    Good thing Mcafee doesn't have liability, via contract, for this mess....

  • Does this mean... (Score:5, Funny)

    by __aaclcg7560 ( 824291 ) on Monday March 13, 2006 @09:06AM (#14906901)
    That Microsoft Anti-Virus will be deleting McAfee from the system? And, to be on the safe side, also Norton?

  • Surprisingly, it didn't quarantine itself (Score:5, Funny)

    by digitaldc ( 879047 ) * on Monday March 13, 2006 @09:09AM (#14906919)
    If only McAfee had quarantined itself before this disaster, it would have worked perfectly!

  • Nortons AV did this to me once... (Score:2, Interesting)

    by craznar ( 710808 ) on Monday March 13, 2006 @09:10AM (#14906927) Homepage
    Scanned my Inbox file, and deleted it because there was a virus in it from before I installed Nortons AV.

    However - like most AV software, you can put it straight back.

    No biggy ..... however I turn off automatic scanning these days... just manually scan every so often.

  • There's gotta be a way to blame this on Bush... (Score:2, Funny)

    by Anonymous Coward on Monday March 13, 2006 @09:12AM (#14906946)
    There's gotta be a way to blame this on Bush. Somehow he was responsible.

  • They asked for it (Score:2)

    by voice_of_all_reason ( 926702 ) on Monday March 13, 2006 @09:14AM (#14906952)
    There's one action that is responsible for almost all computer-related problems -- crashes, virii, corruption -- and that's blindly running code without checking it out first (either yourself if you have the know-how, or waiting for others who do to test it out first).

  • Ouch.... (Score:3, Interesting)

    by Araxen ( 561411 ) on Monday March 13, 2006 @09:14AM (#14906959)
    McAfee doesn't have the greatest rep as it is but this might be the last straw for them.

  • Not surprised (Score:5, Interesting)

    by QuantumPion ( 805098 ) on Monday March 13, 2006 @09:14AM (#14906961)
    This is a major problem with anti-virus software. Because of their blacklist model, they have to release definitions and updates very frequently. They have to release these updates as quickly as possible as well, or else their subscribers will be infected with these viruses before they get the updates. In addition, their software is very bloated and complicated, needing to be able to defend against a huge variety of attacks, both immidiate and obsolete. This results in a very error-likely situation. What the network security companies need to work on is an innovative way to effectively protect corporate and home networks without having to use dangerous bloatware.

    • Re:Not surprised (Score:4, Interesting)

      by MartijnL ( 785261 ) on Monday March 13, 2006 @09:31AM (#14907100)
      Well, Cisco's CSA (http://www.cisco.com/en/US/products/sw/secursw/ps 5057/index.html [cisco.com]) does the exact opposite: you tell it what is allowed to run and it blocks everything else. It also runs a signature analysis so when something that you hadn't configured yet tries to perform an attack it alerts the user. It can become quite a task however to properly configure and you still need user awareness to keep them from clicking "YES" everytime like they do with every other popup they face (the other option is that you manage everything but then you will get flooded with support calls).

      • Re:Not surprised (Score:2)

        by Billosaur ( 927319 ) * <wgrother AT optonline DOT net> on Monday March 13, 2006 @10:09AM (#14907479) Journal
        It can become quite a task however to properly configure and you still need user awareness to keep them from clicking "YES" everytime like they do with every other popup they face (the other option is that you manage everything but then you will get flooded with support calls).

        This would seem to be a good place for the addition of some low-level AI, to learn usage and traffic patterns and be able to anticipate such things. It might even be made smart enough to detect suspicious or erroneous processes/traffic and alert the sys admin so action could be taken. It would then "learn" from the response and be able to become more autonomous as time passed.

    • Re:Not surprised (Score:2)

      by Monkelectric ( 546685 ) <slashdot AT monkelectric DOT com> on Monday March 13, 2006 @10:00AM (#14907391)
      No ... McAfee is just irresponsible. Try another program like Panda or Trend or Avast. I personally think Panda is the best at catching viruses -- but its software is a bit buggy. Trend is a solid performer, and Avast seems to do an ok job but it screws up Visual Studio so I dont use it personally, but I recommend the free version to friends.

  • For what it's worth (Score:4, Interesting)

    by shoptroll ( 544006 ) on Monday March 13, 2006 @09:15AM (#14906966)
    My computer started rebooting randomly a week or so ago, and is something I've been trying to combat for a while. It would do it when idling or when I was in the middle of websurfing.

    I find it interesting that once I disable Mcafee's on-access scanner the system stabilized itself and has been running without a problem for about a week now (I had seen it reboot about 3 times in one day).

    Seeing this article makes me more suspicious of the scanner now.

  • At last ! (Score:3, Funny)

    by alexhs ( 877055 ) on Monday March 13, 2006 @09:15AM (#14906968) Homepage Journal
    At last a good AV software removing those virii-ridden bloatware from your computer :)

    Why are people complaining ?

  • Second time in a month (Score:2)

    by Malc ( 1751 ) on Monday March 13, 2006 @09:16AM (#14906974)
    This is the second time in a month, although much worse than the last one. On the 23rd Feb, my mum asked me about an issue where McAfee had just cleaned Firefox of a trojan: Exploit-MS06-006.gen [nai.com]. Turns out that it was a false-positive and it had needlessly truncated some files.

  • Problems with McAfee (Score:2)

    by NetDanzr ( 619387 ) on Monday March 13, 2006 @09:19AM (#14907004)
    This is not the first problem with McAfee I've had this year. A few weeks ago, something started eating my system resources, pushing total CPU usage to 100%. Through trial and error I found that it was the McAfee virus scan. I found others with the same problem, which convinced me that for a change, the problem was not with the user. I ended up uninstalling McAfee and switching to AVG. Just in time, as I can see...

  • Deletes text files too (Score:2, Funny)

    by psm321 ( 450181 ) on Monday March 13, 2006 @09:19AM (#14907007) Journal
    I had a TEXT file deleted by McAfee just a few days ago. The "virus" that it identified was a different one from the one in this article too. Unfortunately, in the version of VirusScan I have (came with Dell computer) there's practically no configurable options, so I have no way to set it to quarantine instead of delete.

  • Prompt (Score:2)

    by _Shorty-dammit ( 555739 ) on Monday March 13, 2006 @09:19AM (#14907009)
    Exactly why you set that kind of software to prompt you for the action, if any, you'd like it to take. Get what you deserve.

  • Saw it coming (sort of) (Score:5, Interesting)

    by martyb ( 196687 ) on Monday March 13, 2006 @09:21AM (#14907020)

    Just last week, in response to: The Trouble With Software Upgrades [slashdot.org] I posted a question [slashdot.org] asking what do you do to protect yourself from automatic updates that go bad... but I got no responses. In light of the current situation, I'd really appreciate hearing some responses, here.

    • Rollback the OS.

      First, don't have your homedir on your workstation. Then, don't do auto-updates on the file servers.

      Then, for your workstations create images of the disks. Don't let users perform upgrades unless they assume the responsibility for the box. Next, test the update on a limited subset of boxes. If it works then roll it out. If by chance you screwed up rollback to images that are stable and perform the safer updates.

      Generally this is trivial with a proper OS distribution like freebsd, openbsd, Gentoo, etc.

      Tom

    • Re:Saw it coming (sort of) (Score:5, Insightful)

      by simong ( 32944 ) on Monday March 13, 2006 @09:49AM (#14907284) Homepage
      I don't think there really is a way apart from having verifiable restorable backups of every system prior to patching. I was having a conversation along these lines this morning and the agreed solution was to have an identical test platform and install on that first, allow it to run long enough for any problems to arise and only then implement on a production system. That's the ultra-conservative approach but many years in financial services have shown that that's the only way of being certain.

    • Re:Saw it coming (sort of) (Score:2)

      by xtracto ( 837672 ) on Monday March 13, 2006 @10:09AM (#14907481) Journal
      what do you do to protect yourself from automatic updates that go bad...

      Doh! Turn of automatic updates.

      Hehe, kidding aside, seriously that is what I do. I do not do auto upgrades because I find it a bit disturbing that any of my systems installs something else which I have not seen what is it. Granted, sometimes I do not read the Microsoft KB12312412412 patches information but at least I just patch what I believe is worth patching.

      However in a big network it may not be trivial to update manually. Although maybe sysadmins should have a script that allow them to distribute and apply the patches after they have reviewed them. If that is not possible then as somebody else wrote, System Restore is your friend or even DAT tapes!

      ps. with your PIN number in your ATM Machine :-)!

  • McAfee's response (Score:3, Funny)

    by gEvil (beta) ( 945888 ) on Monday March 13, 2006 @09:22AM (#14907028)
    Ummm...Whoops?

  • Good catch (Score:5, Interesting)

    by blueZ3 ( 744446 ) on Monday March 13, 2006 @09:24AM (#14907048) Homepage
    I dunno about the rest of that stuff, but the Adobe update manager is a virus in my opinion.

    It seems to have "infected" all of Adobe's recent product install CDs. Once it "infects" your computer it displays a popup whenever you open an Adobe app. As far as I can tell, there's no way to shut this off in the latest versions. So I've paid $x00 dollars for Acrobat, and it comes with a virus.

  • We lucked out (Score:3, Interesting)

    by PinternetGroper ( 595689 ) on Monday March 13, 2006 @09:25AM (#14907052)
    Our main system here downloads the DAT updates at 2 AM every day. As of Friday morning, it had downloaded the 4714 files, then downloaded the 4716's on Saturday morning, completely missing the 4715's. It appears we missed a bullet. Good luck to all the sysadmin's out there working on cleaning this up!

  • Where should users turn? (Score:5, Insightful)

    by babbling ( 952366 ) on Monday March 13, 2006 @09:28AM (#14907080)
    When the virus scanners act like viruses, what should users do? This isn't the first time a virus scanner has screwed up, and it probably won't be the last time, either.

    Furthermore, a lot of virus scanners have an option to "auto-update". Imagine if an entire company had this option turned on.

    Virus scanners have always been a bad solution to the problem of viruses. They don't fix the problem at its root. Instead of ensuring their operating system has no known security holes, users now rely on virus scanners to just catch everything that comes through. Any determined attacker could still just craft a custom virus to attack any host they desire. Since the virus scanner companies wouldn't have come across that particular virus, it wouldn't get picked up.

    Would you fix the holes in a boat with sticky tape instead of checking that the boat doesn't have holes before you put it in the water?

  • I haven't had any problems (Score:5, Funny)

    by myth24601 ( 893486 ) on Monday March 13, 2006 @09:35AM (#14907144)
    I use McAfee and My system is working fi

  • Ye don't always get what ye pays for (Score:5, Insightful)

    by cgenman ( 325138 ) on Monday March 13, 2006 @09:37AM (#14907158) Homepage
    People percieve paid software to be superior to free alternatives because A: nothing could go wrong with paid software and B: if something did go wrong, obviously the company would indemnify / rectify / fix the problem.

    Likewise, the perception is that the more expensive the software (and the bigger the box it comes in) the more protection you are afforded. And that the company won't suddenly decide to change direction / stop supporting the software / etc.

    Yet time and time again this is shown not to be true. McAfee uninstalls arbitrary files on your computer (how'd that get through testing?) and just tells users to re-install from backup... exactly the kind of calamity the software is supposed to prevent. Part of WinNT5 was found to violate someone's patent, and anyone using that particular (admittedly rare) function had to pony up to the original patent holder or write a workaround.

    As far as I can tell, the "little guys" software tends to be better in general than the big boys. Why? Because they're still trying. Before Norton was Symantec, they struggled to create an amazing toolkit of software tweaks that really did some great things. Now that their position is secure, they've hardly updated the suite to even work with XP, let alone taken advantage of the fixes and hacks that smaller houses have found. McAfee, once a nimble little company making a great little product, has been bloating for years. The more developers you add to a project, the less anyone knows about what the system is doing.

    A free alternative that has been around for a long time:
    AVG Antivirus [grisoft.com]
    There are others. Please post 'em below.

  • McAfee Haiku? (Score:3, Funny)

    by ursabear ( 818651 ) on Monday March 13, 2006 @09:42AM (#14907208) Homepage Journal
    The files they are gone. It seems McAfee ate them. The backup saved us. or The files they are gone. It seems McAfee ate them. Go home from work now.

  • OOPS (Score:2)

    by ROOK*CA ( 703602 ) * on Monday March 13, 2006 @09:46AM (#14907262)
    "False positives aren't uncommon however, but this is something that should be caught during regression testing. "

    Email from the Test Group to Product Marketing:
    "Hey when did we announce an uninstaller product?"
    Email from Product Marketing to Test Group:
    "We didn't"
    Email from the Test Group to Product Marketing:
    "What are we supposed to do with this then?"
    Email from Product Marketing to the Test Group:
    "Just Ship the damn thing whatever it is, we're sick of you guys screwing up our ship dates, now go away"

  • Don't run windows, it's bad ... 'kay? (Score:2)

    by elronxenu ( 117773 ) on Monday March 13, 2006 @10:00AM (#14907390) Homepage
    This is yet another reason to not run windows. If you run windows, the system's so insecure that you have to buy third party applications to check it constantly. These third party applications have the ability to run rampant through your files, destroying critical data without oversight.

    Seriously, who thought this was a good idea, to configure these programs to automatically delete system files? There is always a chance of a false positive - identification of a file which does not contain malware. Are viruses so common in the windows world that it's not worth a human's time to confirm detection before files are altered?

    And why, oh why, is it necessary to maintain huge lists of virus signatures? If windows kept a list of the correct md5sums of the system files it would become a trivial task to verify the integrity of those files. One would not need a daily update of virus signatures. Can I cynically suggest that the need for constant update gives the anti-virus companies a permanent revenue stream? And what does Microsoft get out of the flood of windows viruses?

    Here's a way that Microsoft could design windows to be virus-resistant: designate certain files (system DLLs, EXEs etc) as change-limited. Provide an API into the kernel to permit those files to be changed by windows update software (only when the replacement file is signed by a trusted key). Maintain a file containing the md5sums of all change-limited files. This file would be modifiable only by the kernel.

    In this scenario any virus wouldn't get a chance to corrupt system files because it wouldn't have a correctly signed replacement. And even if it did get to corrupt a system file, it would be trivially detected because the md5sum of the corrupted file wouldn't match the expected md5sum. In order for an infection to occur and be undetected the virus would need to work around the kernel file change API and alter both system file(s) and the md5sums file.

    This scheme can be implemented for vendor software too. Windows needs some kind of database of installed software. Does it not have one already? (checks system clock: yep, it's 2006). Red Hat had RPM and the installed software database since 1995. That's 11 years ago, and Red Hat were probably not the first to hit upon the idea of a centralised list of all software installed on a computer.

  • Ethereal too? (Score:2, Insightful)

    by OrangeDoor ( 936298 ) on Monday March 13, 2006 @10:03AM (#14907421) Journal
    Just noticed the screenshot on the McAfee page for W95/CTX [nai.com]. It shows some dlls from the Ethereal program as being infected. Of course those files are in their complete list [nai.com] of affected files, which comes in a convenient easily accesible PDF file as all the most important documents on the web should. It's 7 pages long, but an amusing list to skim through.

    Who uses Ethereal [ethereal.com] and McAfee? Just found that funny/ironic on some levels.

  • Thank God! (Score:2)

    by DoctorPepper ( 92269 ) on Monday March 13, 2006 @10:04AM (#14907431)
    I don't use Windows! :-)

  • Feeling pretty good (Score:2)

    by dtfinch ( 661405 ) * on Monday March 13, 2006 @10:07AM (#14907456) Journal
    I don't use antivirus software, at least for anything more than manual scanning, but for reasons other than this. Antivirus makes Windows slow and unstable, sort of like some malware does, except it does it all the time.

    I don't get viruses and other malware, because I don't manually install viruses and other malware. People who do need antivirus software.

  • Software Wars (Score:2, Funny)

    by Godji ( 957148 ) on Monday March 13, 2006 @10:17AM (#14907550) Homepage
    [deep bass voice]It's a world where companies wage a security suite war on other companies. The battlefield is your own desktop. Imagine Mysantec's antivirus attempting to delete Facamee's antivirus, before being both obliterated by Sicromoft's security solution still in beta. Wouldn't it be fun to watch as your CPU cycles get all pulled into the fight, with rampant defense software running around your RAM and filesystem, killing each other out, filling your desktop space, and celebrating victory with funny alerts, baloons, dialogs, pop-ups, windows, and what not, all reaching for you attention? Ah, talk about an exciting desktop! (And really, what could be more boring that a computer that just works and leaves you with nothing to do except to work with it?)
    [special effects]
    In the ensuing destruction and chaos, nothing remains alive but two things: the memory of your once existing data, and an unidentified hideous sneaky polar bird determined to show you of an alternate dimension of reliability and freedom...
    [epic music]
    Coming soon, on your desktop: RealityArts presents: THE SOFTWARE WARS, EPISODE 442.75
    [/deep bass voice]

  • Advice for corporate users (Score:3, Informative)

    by futuresheep ( 531366 ) on Monday March 13, 2006 @10:27AM (#14907632) Journal
    This is exactly why I force all my clients to update their DAT's from MY server, not McAfee's, and I push the updates out, the clients never pull them. Along with that, I always wait three to four days before pushing the updates out. Even if you don't use the full McAfee Epolicy Orchestrator, you can still configure the clients to point to an ftp server on your network for updates. Just like with MS patches, it's simply prudent to wait a few days just in case there's any issues like this that may arise.

    I'm not excusing McAfee here, but there are ways that we, as admins can minimize the risk to our users and our network.

  • They are doing a great job! (Score:3, Funny)

    by slashname3 ( 739398 ) on Monday March 13, 2006 @10:35AM (#14907695)
    Actually it sounds like they are doing a great job. They finally targetted the biggest virus of them all, Windows. Maybe this is the start of something really good. Finally the Windows virus is being actively targetted.

  • A tool for media giants (Score:5, Interesting)

    by JasonEngel ( 757582 ) on Monday March 13, 2006 @11:01AM (#14907968)
    Comcast gives away McAfee AV for free to customers, so I tried it out. The only time it ever caught anything at all was a false-positive. Complete file system scans never ever turned up anything. However, if I opened a folder with a file in it called SetupDVDDecrypter_3.5.4.0.exe in it, McAfee would call it a virus and delete it. Didn't matter which version of the installer actually, it would delete it. Didn't matter if the AV program was configured to only quarantine suspect files, it would delete it. Didn't matter if I made an empty text file then renamed it to SetupDVDDecrypter_3.5.4.0.exe, McAfee AV would delete it. If I renamed the installer to something else, McAfee AV did nothing.

    Pretty obvious to me that it was just waiting to find files that media companies didn't like people to have on their own private property so I'm guessing that they must have gotten McAfee to agree to do their dirty work for them and call stuff they don't like a virus and automatically delete the file regardless of settings.

    But that's just my conspiracy theory.

  • Anti-virus as virus? Yeah, I knew that already. (Score:5, Interesting)

    by Whumpsnatz ( 451594 ) on Monday March 13, 2006 @11:10AM (#14908050)
    On an old WinME laptop, the only virus I ever had on it was Norton AntiVirus.

    I worked on a consulting job two years ago, and they told me I could use my own PC. No problem - except that, when I got there, they wanted to check it for virii. In an XP world, I was running Windows ME. So they loaded up Norton on my machine, and ran it for about 3 hours.

    Result? Nothing. No junk of any kind. Completely clean.

    Why? It helped that I had the free version of Zone Alarm, and the firewall on my DSL router definitely helped, but I think the biggest reason I had no problems was

    - Mozilla instead of IE
    - Eudora instead of Outlook.

    Completely clean, that is, except for the antivirus. That monster kept interrupting my work. It took a great deal of effort to get the beast out of my system.

  • Beware of Fridays (Score:3, Insightful)

    by Nom du Keyboard ( 633989 ) on Monday March 13, 2006 @11:29AM (#14908240)
    Always beware of any software updates released on a Friday. If there's a problem, much of the damage will be done before anyone returns on Monday.

  • I can imagine the meeting now... (Score:4, Funny)

    by Obi-w00t ( 943426 ) on Monday March 13, 2006 @12:35PM (#14908857) Homepage
    [Team Leader]: So Steve is new here so, Bob, why don't you show him a simple virus definition for one of these low-priority viruses?
    [Bob]: Sure. This virus is low-threat but can masquarade as numerous file names so why don't you just look for a common pattern and write a REGEXP function?
    [Steve]: Sure.
    [Bob]: You know how to write regular expressions, right?
    [Steve]: Yeah, sure, the one's with the asterisks.
    [Bob]: Erm, yeah. I'll leave you to it. Just send it to the database so it can get filed in the next update.
    [Steve]: OK, see you later.
    *Looks around nervously. Briefly glances at long list of file names then timidly enters:*

    *.EXE

Slashdot Top Deals

As you will see, I told them, in no uncertain terms, to see Figure one. -- Dave "First Strike" Pare

Close