About This Blog   |   Archives   |   RSS Feeds RSS Feed   (What's RSS?)

McAfee Update Flags Hundreds of Innocuous Programs

Anti-virus giant McAfee acknowledged late last week that a recent update to a number of its software products went terribly awry, causing them to flag hundreds of legitimate third-party programs as hostile and prompting users to delete or quarantine them.

The files identified by McAfee as malicious included excel.exe (Microsoft Excel) and gtb2k1033.exe (Google Toolbar installer), as well as programs that run Macromedia Flash Player, Sun's Java application and Adobe update manager.

The erroneous flags even apply to updaterui.exe, McAfee's own update program. The full list of programs errantly marked as bad is here in PDF format, although McAfee only lists the ".exe" files affected, not the names of the software packages.

McAfee flagged the harmless files as "W95/CTX," and obscure Windows 95 virus that McAfee first identified in 2004. McAfee says this problem appeared in updates for VirusScan Enterprise 8.0i, 7.1 and 7.0; Managed VirusScan 4.0 and 3.5; Virus Scan Online 11 and 10; Linux Shield; and VirusScan 7.03 (consumer).

The SANS Internet Storm Center has a decent writeup on the problem, which includes a snippet from a reader who had some 700 files quarantined on more than 100 computers.

The faulty virus-definitions update was pushed out Friday morning. McAfee released a repaired update file around 6:30 p.m. ET.

Batches of so-called "false positives" like this latest round from McAfee are more common than you might think among the anti-virus vendors. TrendMicro had a problem with an update file last April that completely swamped the processing power of the machines running it, effectively shutting down some major corporate e-mail gateways. News.com quotes McAfee's director of operations saying the company is forced to do an emergency update about every three months because of faulty definitions releases.

While I certainly don't want to make light of a situation that is no doubt very serious, especially for people who are cleaning up this mess, I found McAfee's solution for such customers interesting: "Users who have moved detected files to quarantine should restore them to their original location. Windows users who have had files deleted should restore files from backup or use System Restore."

Most anti-virus vendors urge users to delete past restore points when cleaning up real virus or worm infections. This is because those nasties can get backed up along with the rest of the user's settings and files, meaning they could be brought back to life if the user restores the backup snapshot.

Here's hoping the companies and individuals who were just forced to restore their systems didn't also have to grapple with restored real virus infection.

By Brian Krebs |  March 13, 2006; 10:00 AM ET New Patches
Previous: Two Security Updates From Microsoft Next Week | Next: Apple Issues Another Mac Patch Bundle

Comments

Please email us to report offensive comments.



If you think false positives can be a nightmare for the user, imagine being the author of a program that's getting falsely targeted. I released a donationware program called SuperKeys that's pretty sweet if you ask me or many of the fans of the program. I relied on a third party control to do the keyboard scanning and it works perfectly. Unfortunately, that same control was also picked up and used by the a**holes who wrote the SecondSight keylogger. I've been targeted by AVG and SpySweeper in the past, but the real flood of emails came when Norton decided to start targeting me last week. I've tried to explain to them that they're targeting an innocent tool that does nothing more than scan the keyboard and they should target the actual malicious part of SecondSight that tries to send the information out over the Internet. Unfortunately, it seems neither of these companies seem willing to understand the distinction. Oh well, the program works perfectly as it is so I'm not going to re-invent the part that scans the keyboard. For those who enjoy the software and understand the explanation, they've got a great piece of software free to use on their systems. For those who blindly assume their anti-virus programs are incapable of making mistakes, it used to get me down, but now I really don't care any more so when the hate mail and death threats come in, I just read it and laugh.

Posted by: Vellosoft | March 13, 2006 11:04 AM

Years ago I ran McAfee Antivirus in autofix mode only to have it "fix" hundreds of files, including my Windows Registry and a number of system DLLs. My system tanked big time and I was, with great difficulty, able to recover some work files from it. Haven't used McAfee since.

Posted by: Will | March 13, 2006 11:29 AM

"...700 files quarantined on more than 100 computers."

That thats nothing, our corporation had 500,000 files deleted on more than 6,500 machines. We were in all weekend trying to fix this problem, shall we foot the bill to Mcafee?

Posted by: anonymous | March 13, 2006 11:56 AM

Having a problem with Microsoft Office 2003 updates, could this be McAfee causing the problem? I read this article and am a little lost in it's content and message.

Posted by: Robert Dixon | March 13, 2006 12:40 PM

why use a program that does not do what it was designed to do? Norton all the way, never McCrappy.

Posted by: McCrappy | March 13, 2006 1:06 PM

or TrendMicro, all though they are pritty much a resouce hogg (160MB with every thing enabled, 40MB with only the essentials; ie. Firewall, Spyware, AV, and mail scanner), finds much more than NAV ever will.

Posted by: Longbow | March 13, 2006 1:33 PM

Yet, I think, in this same column, you quoted research on how long it takes virus defs to get published by the majority of AV vendors. I believe you and/or the numbers quoted were rather critical of the larger companies for the time it takes to get the new defs out. Maybe this is a good reason why the larger firms do more extensive QA on their work, and even then some things get out.

Posted by: Timing | March 13, 2006 1:50 PM

Near the end of last week I saw my first blue screen of death on more than 4 years on my second Windows XP computer with McAfee antivirus protection and Zone Alarm Pro firewall. Each time I would restart, I would get the blue screen and have to unplug the computer. Finally I interrupted the startup sequence and after one more attempt to startup normally--went into safe mode. Fortunately I have another computer and downloaded some additional registry cleaning tools. I used Cache Cleaner (a freebie), but a Sonic Blue tool found more problems in the registry -- over 106. I eliminated these problems, and since that time, my computer has started acting normally. Want to bet that McAfee updating and installing produced the BSD incident?
It is not obvious that I lost any files, but something definitely changed overnight to produce a BSD!

Posted by: Dan | March 13, 2006 2:27 PM

This whole thing is ironic.

You have to accept a virus to get infected and lose data.

You do not have to accept an anti-virus to lose data.

Which one was the virus again?

Posted by: Ivan Thomson | March 13, 2006 3:17 PM

Because of the occasional malfunctions with the daily DAT file, I turned off the auto-update.

I update my McAfee manually in the evening, after others have "beta-tested" the McAfee DAT file during the day. For once, living on the West coast had its advantages: the fixed file was rolled out 3:30 pm PST, long before I turned on my home PC that night. Thus, I never got the problem DAT file.

To avoid bad definition files at home:
Don't leave your PC turned on, connected to the Internet, and auto-update active.

Posted by: Ken L | March 13, 2006 4:14 PM

It hit my machine. It quarantined most of the Windows System Restored files as well. I tried a restore and it failed. Ultimately, finding the quarantine files (84 of them) and renaming them, then dragging them back to the right folder, worked. Almost lost my system on that one.

Posted by: Dave | March 13, 2006 5:17 PM

Hmm, makes me glad I don't have any antivirus software. But then, I have a Mac.

Posted by: dokein | March 13, 2006 5:43 PM

Sounds like we need a massive agency where all software that is downloaded or used public is listed in a large database where all companies have access to it. It could have a large list of things about the software and what it does. Like what information is being collected, sent ect..
Then when your using your anti-virus software you can decide what is and acceptable risk by using a checklist by the most dangerous to the least. The program also has and option to automatically delete any software that is not stored in the database. The developer pays a small fee for their software to be analysed(support the website), in return they have the peace of mind knowing it won't be deleted just because some company decides its not safe. It would create some kind of standard, because as of know every virus program decides on their own.

Posted by: jonathan | March 13, 2006 5:58 PM

Hmmm. Too bad I don't just have these problems; nope, mine are worse than this.

Posted by: | March 13, 2006 7:04 PM

i switched to linux due to the failure of another brand antivirus program. havent had any problems since. it was one of the high rated ones that included antivirus, firewall, popup blocker, and anti spam. it was updated daily.

Posted by: e w | March 13, 2006 7:06 PM

Mcaffee is no worse than the rest of the corporate thieves i producing less than favorable antivirus software. I have yet to see any one antivirus program boast 100% success, and as such they're always updating their definitions to catch 'variants' of the same virus, whereas a proper definition in the first place would have caught all variants... Seems someone is more interrested in having their hands in your pockets than actually performing the service they are selling their products to perform.

And to quote "Hmm, makes me glad I don't have any antivirus software. But then, I have a Mac." sounds a little arrogant; then again, the only viruses of any consequence affecting a Mac exploit bugs in Microsoft code (MS Word macros, etc.)

All antivirus continue to 'improve' their features, which then normally break normal functionality of programs that once worked great. Take your pick, vulnerability to any virus that comes along and lose your data - or trust your antivirus vendor and lose your data to flaws in their software when it automatically updates itself.

Posted by: Rolly | March 13, 2006 7:49 PM

last year i received notification of a virus from mcafee. after that i could not do any thing . i am not too literate with computers and relied on a virus program to save me. little did i know that it was the wrong one.
as a result i had to spend money and re format my hard disc . reinstall win 98 i purchased EZ anto virus and it works well

Posted by: old8dol@lworld.net | March 13, 2006 8:35 PM

Spent the weekend restoring 148 servers and 3200 workstations in 6 hospitals thanks Mcaffe.

Posted by: PPalmer | March 13, 2006 9:10 PM

Norton antivirus, McAfee, Trend Micro, all are funny. Notice they never work properly, all detect some things and half the time do nothing about it (hint to you norton fans of "threats"). Stick with CA Antivirus, never done me wrong in years.

Posted by: ROFLMAO | March 13, 2006 9:12 PM

...and the so called IT expert I was working with looked at me weird when I laughed, after asking them what AV software they recommend to secure our LAN.

"why McAfee and Nortons".....*smirk*.. yah right...

YOUR fired!...

Next prospect, please..

Posted by: DOUGman | March 13, 2006 11:46 PM

I removed MCAFEE from my computer as soon as I got it from Dell. It is no easy matter, It took more than 3 hours. When I saw how it took over my machine it went. Thank god. Use adaware and spydoctor.

Posted by: Giorgio | March 14, 2006 12:50 AM

had over 1000 machine infected over the weekend and the only saving grace was a short VB script that moved everything back from the c:\quaratine directory to where it came from.
as much as McAfee says this happens it's surprising they don't have something off the shelf to help their customers get through it. without this script we would have been toast!

Posted by: green | March 14, 2006 7:55 AM

I'm even more grateful that 'automatic updates' are not enabled on my machine. Missed all the fun. Sorry!

Posted by: MCL | March 14, 2006 10:43 AM

With companies and crappy products like McAfee, who needs cyberterrorist.

I am sure Osama Bin Laden would be writing a big check to McAfee CEO.

Manish

Posted by: Manish | March 14, 2006 11:35 AM

This episode extends the analog between human and computer viruses. McAffee seems to have created an auto-immune disorder.

Posted by: JohnH | March 14, 2006 12:26 PM

McAffe and NORTON are the worst aniViral software on the market with the greatest share due to agressive marketing!

I used McAfee since 1995 and dumped it as it several times froze my OS and wouldn't boot at all with CPU usage @ 100% (version 6 !!). (to heavy on PC resources and fucking up the CPU use making PC literally unusable - 100%).
Despite that McAffe knows that their antyviral softwar was in conflict with McAffe firewall they ignored customers stealling their money. "You got it it is yours so don't bother us."
McAfee must learn how to deal with base of repeat users.
Last time when I wanted to upgrade the McAfee version despite that I 've been registered with McAfee I was told that my email address is NOT in McAfee data base.

Since than I switched to Trend Micro Pccillin (now 2006) which is really excellent!

Norton is a real nightmare.

You can not remove that crap from your PC! as it sits in the root.

I highly recommend all to try PcCillin 2006, as it beats any other antyviral software!

Posted by: McLaren | March 14, 2006 3:21 PM

Posted by: DOUGman | March 15, 2006 2:08 PM

I was Baffled by Norton Works, couldn,nt schedule. McAfee kept wanting me to prove I was Administrator. I gave up when I learned it wasn't reporting hits to Hackerwatch.org. I run Norton Internet Sycurity which seems to be jammin, no problems and right on time. I have Sbyboy S&D, Lavasoft, WinPatrol and Trend Micro anti spyware which keeps my browser anchored. This is good. Between Ad-Aware (Ad-Watch) and Trend Micro Venus trap

Posted by: Underwing@direcwat.com | March 22, 2006 11:00 PM

wow, i usually don't trust internet, so i use CyberScrub AntiVirus , it can provide antivirus protection for home computers.
http://www.yaodownload.com/utilites/antivirus/cyberscrub-antivirus/

Posted by: tom | April 16, 2006 9:14 PM

After installing McAfee Enterprise addition to test why it is causing our PDF writer to create empty files on customers networks that are using it I was no longer able to shut down the computer or to Add/Remove programs.

I had to manually delete all McAfee files, remove all registry entries, reset permissions on all registry entries, and now at least I can shut down and add/remove programs.

What a mess!

Posted by: | June 13, 2006 7:45 AM

mcafee does not update and mcafee cannot find or solve my problem after numerous attempts...they have promised me that they will be in touch by telephone or email with their expert ..still waiting after 2 days for contact...nobody cares ..they take the 90$ and that is that...its a case of tough luck...what chance has an individual fighting them for a refund...none...totally disatisfied with them...think twice befor you consider using them....

Posted by: marilyn | July 23, 2006 6:16 AM

McAfee's management has been slacking off, hence they did not see this coming. Also, inside management has been working with Symantec to bring down McAfee.

Posted by: McDowner | July 24, 2006 10:24 PM

I recently downloaded the new McAfee upgrade 9. My computer has come to a stand still. It is much slower than dial up ever was. I have spent several hours online with McAfee only to be told that I need to be patient. I don't understand how upgrading my virus software has brought my computer to a halt. I'm not extremely computer savvy but I am extremely frustrated with McAfee. This isn't the first time I've had such problems with their customer service techs.

Posted by: michelle | August 4, 2006 8:53 AM

About two weeks ago, my PC crashed in the middle of upgrading McAfee software. I lost everything. Last week, I received an e-mail from Bill Kerrigan, Executive Vice President McAfee Inc. He apologized to their customers. Here is one paragraph from his e-mail:

"While the majority of subscribers who upgraded had no issues, we have learned that some did experience difficulties. We would like to extend our sincere apologies to anyone who may have had problems with their computers due to the upgrade."

What I don't understand is how such problem could be brought by one of popular antivirus companies. They are paid and supposed to protect our PCs from virus and not to destroy them. I'm so frustrating and upset with it.

Posted by: Wu | September 12, 2006 3:57 PM

The comments to this entry are closed.

 
 

©  The Washington Post Company