Members
  • Total Members: 14176
  • Latest: toxxxa
Stats
  • Total Posts: 42869
  • Total Topics: 16078
  • Online Today: 3869
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)









Author Topic: McAfee false-positive glitch fells PCs worldwide (IDing, winvnc.exe, PWS!hv.aq)  (Read 10127 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7528
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


IT admins across the globe are letting out a collective groan after servers and PCs running McAfee VirusScan were brought down when the anti-virus program attacked their core system files. In some cases, this caused the machines to display the dreaded blue screen of death.

Details are still coming in, but forums here: http://forums.mcafeehelp.com/showthread.php?p=569669 and here: http://forums.mcafeehelp.com/showthread.php?t=231904 show that it's affecting McAfee customers in Germany, Italy, and elsewhere. A UK-based Reg reader, who asked to remain anonymous because he was not authorized by his employer to speak to the press, said the glitch simultaneously leveled half of a customer's 140 machines after they updated to the latest virus signature file.


"Literally half of the machines were down with this McAfee anti-virus message IDing valid programs as having this trojan," the IT consultant said. "Literally half the office switched off their PCs and were just twiddling their thumbs."

When the consultant returned to his office he was relieved that his own laptop, which also uses VirusScan, was working normally. Then, suddenly, when it installed the latest McAfee DAT file, his computer was also smitten. The anti-virus program identified winvnc.exe and several other legitimate files as malware and attempted to quarantine them. With several core system files out of commission, the machine was rendered an expensive paperweight.

A McAfee representative in the US didn't immediately respond to phone calls seeking comment. Friday is a holiday for many US employees in observance of Saturday's Independence Day.

Based on anecdotes, the glitch appears to be caused when older VirusScan engines install DAT 5664, which McAfee seems to have pushed out in the past 24 hours. Affected systems then begin identifying a wide variety of legitimate - and frequently crucial - system files as malware. Files belonging to Microsoft Internet Explorer, drivers for Compaq computers, and even the McAfee-associated McScript.exe were being identified as a trojan called PWS!hv.aq, according to the posts and interviews.

We're still trying to determine how widespread this false-positive glitch is being felt and whether people have found any reliable fixes. If you have insight, please leave a comment below.

(The Register)

Samker's Computer Forum - SCforum.info


jake2pointzero

  • SCF Member
  • **
  • Posts: 53
  • KARMA: 6
Samker,

What is the older VirusScan engines that cause the glicth?

jake

Samker

  • SCF Administrator
  • *****
  • Posts: 7528
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Samker,

What is the older VirusScan engines that cause the glicth?

jake


Jake, I'm not sure about this "number"...

But when I was "speak" with "Steve_53" he told me that this v. is 5100, please contact them via PM for more info. ;)

Regards,

S.


mashed

  • SCF Member
  • **
  • Posts: 63
  • KARMA: 10
  • Gender: Male
    • Stressed
wow this doesnt sound good, thanks for the info.


ravi_and

  • SCF Member
  • **
  • Posts: 14
  • KARMA: 1
May be fortunatelly from past few days i'm trying to update the Mcafee 8.5i DAT but due to some unrecoganized error it failed, may be that's why i'm safe, if anybody has a solution of rectifying this unrecoganized error please help me out.

Samker's Computer Forum - SCforum.info


georgecloner

  • SCF VIP Member
  • *****
  • Posts: 171
  • KARMA: 16
  • Gender: Male
These are serious drawbacks for McAfee.

Before it was their McAfee 8.7 faulty update, now they did it again! - "ANOTHER UPDATE PROBLEM." More serious affecting servers with BSOD.

Quote
What is the older VirusScan engines that cause the glicth?

jake

Post info include:

Quote
Hello All

We have a problem on several servers after installing latest patches
two servers are: W2k AS SP4 with McAfee VSE 8.7 patch1 and hotfix
one server: W2k AS SP4 with McAfee VSE 8.5 patch8 and hotfix

All servers are domain controllers and have Exchange 2000 SP3 installed.

Blue screen comes with parameters:
STOP 0x0000001E (0xC0000005,0x8046E3B2,0x00000000,0x00000000)

uninstalling mcAfee and installing version before last patch solves the problem.

Please help

Quote
Windows server 2000 sp3
VirusScan Enterprise 7.1

100 server affected

Quote
I noticied about this ptoblem just in XP workstations with VSE 8.0

Quote
We have had it confirmed by McAfee support that this problem is due to the old engine and that the only solution is to upgrade. There will be no further assitance in doing this (or fixing the issue) provided by McAfee.

We have also had it confirmed by another vendor that this is a false positive and are now currently attemtping to restore the machines affected.

This forum discussion was also highlighted to McAfee during the support call.  
 :-[

Problematic ones are those who where running on McAfee older than the 8.5 in which update and support are no longer being supported by McAfee.  

In my point of view, the servers maybe compromised with the unsupported updates from their workstations (having old McAfee's) which directly infesting the server once the server begins to install the updates shutting down McAfee VS engine in an online infected network.
Creativity is a mental and social process involving the generation of new ideas or concepts, or new associations of the creative mind between existing ideas or concepts.

F3RL

  • SCF Advanced Member
  • ***
  • Posts: 171
  • KARMA: 18
  • Gender: Male
Glad I changed my AV to Antivir (Free). But, why would the AV detect winvnc.exe as a threat? I have RealVNC too.
well? understand ma bad English.

whales

  • SCF Member
  • **
  • Posts: 17
  • KARMA: 2
thanks samker for alerting us. wow!!! mcafee is turning into something else, lets pray they find a solution to its fast 'cos thats still my number one antivirus.

Samker

  • SCF Administrator
  • *****
  • Posts: 7528
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
You welcome my friend.

What to say... same thing ("false positive detection") occur with Kaspersky, Symantec... and now with McAfee.

For example:

"Kaspersky inadvertently quarantines Windows Explorer": http://scforum.info/index.php/topic,1338.0.html

"Symantec accidentally warns of internet meltdown": http://scforum.info/index.php/topic,1123.0.html

Samker's Computer Forum - SCforum.info


 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising