McAfee update causing issues

stapp · Apr 21, 2010

Some info here

http://www.pcreview.co.uk/forums/thread-3999026-1.php

IBK · Apr 21, 2010

here the solution for those who were affected by this FP:
https://kc.mcafee.com/corporate/index?page=content&id=KB68780

plz avoid downplays like "they just need to restore the affected files from quarantine..."

stapp · Apr 21, 2010

That page never seems to load IBK.

Does it for you?

IBK · Apr 21, 2010

Yes, but its slow (I copied it, see below). Probably too many users loading it right now (on another mcafee subsite I get the message:

Site Undergoing Maintenance

This site is currently down, but will be back shortly.

(Apr 21)
Note:

Please wait a few minutes, and try doing whatever it was that you were doing again.

Corporate KnowledgeBase
False positive detection of w32/wecorl.a in 5958 DAT
Printer Friendly Version Printer Friendly Rate Content Rate this Page

Corporate KnowledgeBase ID: KB68780
Published: April 21, 2010

Environment

For details of all supported operating systems, see KB51109
Summary
McAfee is aware of a w32/wecorl.a false positive with the 5958 DAT file that was released on April 21, 2010.
Problem
Blue screen or DCOM error, followed by shutdown messages after updating to the 5958 DAT on April 21, 2010.
Solution

WARNING: If you have not done so already, do NOT download the 5958 DAT and disable all automatic pull and update tasks.

Please watch for updates on this issue, which will be sent on a timely basis through Support Notification Service (SNS) and Platinum Proactive notifications.

To subscribe to SNS, visit http://my.mcafee.com/content/SNS_Subscription_Center.

This article will be updated as additional information becomes available.

To receive email notification when this article is updated, click Subscribe at the top of the page. (You must be logged in at https://mysupport.mcafee.com to subscribe.)
Workaround 1
McAfee has developed an EXTRA.DAT to suppress this detection. The file is attached to this article. This EXTRA.DAT does not fix the issue, it only suppresses the detection.

Apply the EXTRA.DAT to all potentially affected systems as soon as possible.

For systems that have already encountered this issue, start the computer in Safe Mode and apply the EXTRA.DAT. After applying the EXTRA.DAT, restore the affected files from Quarantine.

To apply the EXTRA.DAT locally:

IMPORTANT: For VirusScan Enterprise 8.5i and later, an Access Protection feature must be temporarily disabled before proceeding. For instructions on how to temporarily disable Access Protection in the VirusScan Console, see KB52204.

To apply the EXTRA.DAT locally:

1. Download the EXTRA.ZIP file attached to this article and extract the EXTRA.DAT file.
2. Click Start, Run, type services.msc and click OK.
3. Right-click the McAfee McShield service and select Stop.
4. Copy the EXTRA.DAT file to the following location:

<installation drive>\Program Files\Common Files\McAfee\Engine

5. In the Services window, right-click McAfee McShield and select Start.

For instructions on how to deploy the EXTRA.DAT through ePolicy Orchestrator (ePO), see:

* ePO 4.0 - KB52977
* ePO 4.5 - KB67602

To restore files from Quarantine locally:

1. Open the VirusScan Console.
2. Double-click Quarantine Manager Policy.
3. Click the Manager tab.
4. Right-click the required item and select Restore.

For additional information, see the VirusScan Enterprise Product Guide for your version of VirusScan Enterprise.

For instructions on how to use an ePolicy Orchestrator Scheduled task to restore quarantined files, see the ePolicy Orchstrator Product Guide.
Related Information

Threat Center (McAfee Avert Labs) http://www.mcafee.com/us/threat_center/
Search the Threat Library http://vil.nai.com/
Submit a virus sample https://www.webimmune.net/default.asp
Security updates and DAT files http://www.mcafee.com/apps/downloads/security_updates/dat.asp?region=us&segment=enterprise

For additional information about EXTRA.DAT files, see KB68759.
Click to expand...

stapp · Apr 21, 2010

Thank you for taking the trouble to copy and paste the details, it may help a McAfee user here who reads it here.

Fly · Apr 21, 2010

Being a former McAfee user, this doesn't surprise me.

Just one of those broken DATs. This time with more impact than usual.

CloneRanger · Apr 21, 2010

If memory serves me correctly, this isn't the first time something major like this has happened with a McAfee update.

How is the average person expected to cope with this, and command prompts etc ? Or is this just a corporate AV fiasco ?

If it's not just corporate, then a heck of a lot of people will be screwed, with no easy way out. Glad i don't know anyone with McAfee, otherwise my phone would be red hot.

IBK · Apr 21, 2010

McAfee response: http://siblog.mcafee.com/support/mcafee-response-on-current-false-positive-issue/

In the past 24 hours, McAfee identified a new threat that impacts Windows PCs. Researchers worked diligently to address this threat that attacks critical Windows system executables and buries itself deep into a computer’s memory.

The research team created detection and removal to address this threat. The remediation passed our quality testing and was released with the 5958 virus definition file at 2.00 PM GMT+1 (6am Pacific Time) on Wednesday, April 21.

McAfee is aware that a number of customers have incurred a false positive error due to this release. Corporations who kept a feature called “Scan Processes on Enable” in McAfee VirusScan Enterprise disabled, as it is by default, were not affected.

Our initial investigation indicates that the error can result in moderate to significant issues on systems running Windows XP Service Pack 3.

The faulty update was quickly removed from all McAfee download servers, preventing any further impact on customers. We are not aware of significant impact on consumers.

McAfee teams are working with the highest priority to support impacted customers. We have also worked swiftly and released an updated virus definition file (5959) within hours and are providing our customers detailed guidance on how to repair any impacted systems.

We are investigating how the incorrect detection made it into our DAT files and will take measures to prevent this from reoccurring.

We sincerely apologize for the inconvenience this has caused our customers and will update this blog posting as more details become available.
Click to expand...

Triple Helix · Apr 21, 2010

It's in the TV news here in Ontario, Canada Constant reboots they say!

TH

Cudni · Apr 21, 2010

http://www.pcreview.co.uk/forums/showpost.php?p=13941614&postcount=33
"..
McAfee deleting the SVCHOST.EXE file from the SYSTEM32 directory.
.."

not good at all

Macstorm · Apr 21, 2010

I was to post about the same theme:

AssociatedPress/Yahoo!News http://news.yahoo.com/s/ap/20100421/ap_on_hi_te/us_tec_mcafee_antivirus_flaw

McAfee antivirus program goes berserk, freezes PCs

NEW YORK – Computers in companies, hospitals and schools around the world got stuck repeatedly rebooting themselves Wednesday after an antivirus program identified a normal Windows file as a virus.

McAfee Inc. confirmed that a software update it posted at 9 a.m. Eastern time caused its antivirus program for corporate customers to misidentify a harmless file. It has posted a replacement update for download.

McAfee could not say how many computers were affected, but judging by online postings, the number was at least in the thousands and possibly in the hundreds of thousands.

McAfee said it did not appear that consumer versions of its software caused similar problems. It is investigating how the error happened "and will take measures" to prevent it from recurring, the company said in a statement.

The computer problem forced about a third of the hospitals in Rhode Island to postpone elective surgeries and stop treating patients without traumas in emergency rooms, said Nancy Jean, a spokeswoman for the Lifespan system of hospitals. The system includes Rhode Island Hospital, the state's largest, and Newport Hospital. Jean said patients who required treatment for gunshot wounds, car accidents, blunt trauma and other potentially fatal injuries were still being admitted to the emergency rooms.

In Kentucky, state police were told to shut down the computers in their patrol cars as technicians tried to fix the problem. The National Science Foundation headquarters in Arlington, Va., also lost computer access.

Intel Corp. appeared to be among the victims, according to employee posts on Twitter. Intel did not immediately return calls for comment.

Peter Juvinall, systems administrator at Illinois State University in Normal, said that when the first computer started rebooting it quickly became evident that it was a major problem, affecting dozens of computers at the College of Business alone.

"I originally thought it was a virus," he said. When the tech support people concluded McAfee's update was to blame, they stopped further downloads of the faulty software update and started shuttling from computer to computer to get the machines working again.

In many offices, personal attention to each PC from a technician appeared to be the only way to fix the problem because the computers weren't receptive to remote software updates when stuck in the reboot cycle. That slowed the recovery.

It's not uncommon for antivirus programs to misidentify legitimate files as viruses. Last month, antivirus software from Bitdefender locked up PCs running several different versions of Windows.

However, the scale of this outage was unusual, said Mike Rothman, president of computer security firm Securosis.

"It looks to be a train wreck," Rothman said.
Click to expand...

syk69 · Apr 21, 2010

My corporation was affected by this. Lets just say its been a long day fixing the thousand users affected in our company. No way to auto deploy fix as svchost.exe corruption prevents network access. The fix isn't so bad as you can boot up into PE usb drive and copy over a healthy svchost.exe and extra.dat in appropriate location, restart machine and its good to go. Problem is when it affects thousands of users in big corporations or not as computer knowledgeable users. That being said...I was never a big fan of McAfee and now even more so.

Safe mode doesn't always work to copy over the needed files. That's why I recommend booting up with a BartPE/WinXPPE/ubcd4win cd or usb drive.

STRYDER · Apr 21, 2010

HA!
Where are the posters who said programs with less FP's are less effective?

owned in the face.

Triple Helix · Apr 21, 2010

This is a very interesting article: http://isc.sans.org/diary.html?n&storyid=8671

How McAfee turned a Disaster Exercise Into a REAL Learning Experience for Our Community Disaster Team
Click to expand...

Enjoy,

TH

JimIT · Apr 21, 2010

STRYDER said:

HA!
Where are the posters who said programs with less FP's are less effective?

owned in the face.
Click to expand...

Exactly. FP's are a VERY big deal.

Zombini · Apr 22, 2010

JimIT said:

Exactly. FP's are a VERY big deal.
Click to expand...

Agree completely. There are a lot of so call "security consultants" or "security experts" here that claim that they rather have an FP than have a missed detection. Frankly I dont know what they are smoking, because in the real-world FPs do matter. They affect business much more than your average missed rogueAV.

siljaline · Apr 23, 2010

McAfee false positives bricks enterprise PCs worldwide

Enterprise customers of a widely used McAfee anti-virus product were in a world of hurt on Wednesday after an update caused large swaths of their machines to become completely inoperable.

The problem started around 2 pm GMT when McAfee pushed out DAT 5958 to users of VirusScan Enterprise. The virus definition falsely identifies a core Windows file as infected, quarantines it and then shuts down the machine. When restarted, the PCs are unable to load Windows, a glitch that mires them in an endless reboot cycle.

"We support customers' platforms, and it means we are currently unable to do that," said the head of infrastructure security for a worldwide IT firm who asked not to be identified because he's not authorized to speak to the press. "Basically, our engineers are currently unable to work."

In a statement, McAfee said the false positive "can result in moderate to significant performance issues" on machines running Windows XP service pack 3, and that the defective definition has been removed from download servers. The infrastructure security head said XP machines running SP 1 and SP 2 were also affected.

"McAfee teams are working with the highest priority to support impacted customers and plan to provide an update virus definition file shortly," the statement continued. "McAfee apologizes for any inconvenience to our customers."
Click to expand...

More at above Link

Things go from bad to worse as McAfee probes why

apm · Apr 22, 2010

"The remediation passed our quality testing ..."

Trojan/Rouge try to keep your machine running to steal, FPs try to kill it ASAP.

vijayind · Apr 22, 2010

This would be a good time for competitors to provide "switch offers". Eset looks attractive esp. with their buyout clause.

AvinashR · Apr 22, 2010

Microsoft Alert:-

What is the purpose of this alert?

Microsoft has been made aware of an issue with a McAfee DAT file update - released Wednesday, April 21, 2010 - that has been causing stability issues on Windows XP client systems. The symptom is caused by a false-positive detection on a core Windows file (svchost.exe). Once the file is quarantined by McAfee, the system may encounter one of the following symptoms:

· The computer shuts down when a DCOM error or a RPC error occurs

· The computer continues to run without network connectivity.

· The computer triggers a Bugcheck (Blue Screen).

The DAT file version that that caused the problem is McAfee DAT 5958. This file was propagated to client machines that conduct automatic updates of definition files. McAfee updated the DAT file soon after the problem was identified with a new version that does not cause the problem.

tgell · Apr 22, 2010

Article

McAfee for its part said "we are not aware of significant impact on consumers. We believe that this incident has impacted less than one half of one percent of our consumer base and enterprise accounts globally," it said.

Micro-blogging service Twitter was flooded with complaints by users about Santa Clara, California-based McAfee, one of the world's leading providers of anti-virus software and computer security systems.

"It is not often that a security vender takes out a large number of their clients," Enderle said. "Customers don't forget this stuff any time soon. This is going to hurt McAfee."

Among the US universities reporting problems was the University of Michigan. The website AnnArbor.com said 8,000 of the 25,000 computers in the university's health system and medical school were hit.
Click to expand...

tgell · Apr 22, 2010

Latest updated article

By the end of the day, the antivirus vendor still couldn't say exactly what caused the problem. "We're investigating how it was possible some customers were impacted and some not," said Joris Evers, a McAfee spokesman, speaking via instant message. One common factor amongst the victims of the glitch, however, is that they'd enabled a feature called "Scan Processes on Enable" in McAfee VirusScan software.

Added in version 8.7 of the product, this feature lets McAfee's malware scanner check processes in the computer's memory when it starts up. According to Evers, it is currently not enabled by default. However, some versions of VirusScan did ship with it enabled.

In Iowa, a local disaster response exercise was disrupted when 911 computer systems crashed, according to Deb Hale a Security Administrator with Internet Service provider Long Lines in Sioux City, Iowa. County IT staff soon started getting calls from other departments --- including police, fire and emergency response -- and began an emergency shutdown of all computers on the assumption that a virus was spreading.

After finishing the exercise, using a radio system for dispatch, participants learned that there was no virus, just a bad McAfee update, Hale said in a blog post. "Thanks to McAfee we were forced to test our response to a disaster while in the midst of a real 'disaster,'" she wrote.
Click to expand...

lubieplacki · Apr 22, 2010

McAfee can by this situation lose a lot of their previous clients. But problems like that happend before and will happen in the future. Everyone big company is exposed for trouble like that.

Fly · Apr 22, 2010

STRYDER said:

HA!
Where are the posters who said programs with less FP's are less effective?

owned in the face.
Click to expand...

It all depends on the kind of false positives (Windows system files ?) and how the AV handles it.

In my case, Avira will prompt me before doing anything.

Daveski17 · Apr 22, 2010

I always worry about this happening. I have McAfee but I'm using Vista. Knowing my luck, if I switch to another AV it will do something like this!

Log in or Sign up

McAfee update causing issues

stapp Global Moderator

IBK AV Expert

stapp Global Moderator

IBK AV Expert

stapp Global Moderator

Fly Registered Member

CloneRanger Registered Member

IBK AV Expert

Triple Helix Specialist

Cudni Global Moderator

Macstorm Registered Member

syk69 Registered Member

STRYDER Registered Member

Triple Helix Specialist

JimIT Registered Member

Zombini Registered Member

siljaline Registered Member

apm Registered Member

vijayind Registered Member

AvinashR Registered Member

tgell Registered Member

tgell Registered Member

lubieplacki Registered Member

Fly Registered Member

Daveski17 Registered Member

Log in or Sign up

McAfee update causing issues

stapp Global Moderator

IBK AV Expert

stapp Global Moderator

IBK AV Expert

stapp Global Moderator

Fly Registered Member

CloneRanger Registered Member

IBK AV Expert

Triple Helix Specialist

Cudni Global Moderator

Macstorm Registered Member

syk69 Registered Member

STRYDER Registered Member

Triple Helix Specialist

JimIT Registered Member

Zombini Registered Member

siljaline Registered Member

apm Registered Member

vijayind Registered Member

AvinashR Registered Member

tgell Registered Member

tgell Registered Member

lubieplacki Registered Member

Fly Registered Member

Daveski17 Registered Member

Useful Searches