Topic: McAfee downplays service pack fail, false positive detection W32/Generic.worm.aa

[georgecloner]

Virus update leaves PCs unbootable

A recent McAfee service pack led to systems being rendered unbootable, according to posts on the security giant's support forums.

The mandatory service pack for McAfee's corporate Virus scanning product, VSE 8.7, was designed to address minor security bugs but instead tagged windows system files as malware. The software update was issued on 27 May and pulled on 2 June, after problems occurred. Users were advised to keep the patch if they'd already installed it in a low-key announcement on McAfee's knowledge base.

Posts on McAfee's support forum paint a different picture of PCs and server left unbootable after the update had automatically deleted Windows systems files wrongly identified as potentially malign. Our source among the McAfee user community, who asked not to be named, described the incident as a "massive fail" by McAfee and reports that sysadmins are angry that a long awaited patch turned out to do more harm than good.

In a statement, McAfee acknowledged potential problems but said that these were rare. It said it planned to reissue the service pack once glitches with the software were ironed out.

    McAfee removed Patch 1 for McAfee VirusScan Enterprise 8.7i from its download servers out of precaution after a potential issue with the update was discovered. A very small number of customers reported trouble with the patch on a limited number of computers.

    Once the cause of the problem has been identified and the issue has been resolved, we will repost Patch 1. Customers should contact McAfee support if they have any questions regarding this issue, and check the McAfee ServicePortal for further updates.

Problems with anti-virus scanner definition updates that result in false alarms against harmless files are a well known Achilles' heel of security software. The issue causes more trouble in cases where system files are flagged as potentially malign. The problems with McAfee's enterprise security software are arguably even worse than that because they involve a service pack and not just regular definition updates.

McAfee users have every right to ask tough questions about the security giant's quality assurance and testing regime even if, as McAfee states, only a small percentage of users ran into problems.

{theREGISTER}

Mcafee Corporate Knowledgebase
False positive detection for W32/Generic.worm.aa with VirusScan Enterprise 8.7i Patch 1...https://kc.mcafee.com/corporate/index?page=content&id=KB65943

[georgecloner]

Lucky for me I still have 8.5i in my system. 

[haz]

Lucky for me I still have 8.5i in my system. 

Me too ! phew !

[mashed]

Lucky for me I still have 8.5i in my system. 

Me too ! phew !

+1

[jake2pointzero]

lucky for me to, i'm still using the VSE 8.5i. I think 8.7 is still in beta stage.

[jake2pointzero]

Samker,

Is there a RTM version of the VSE 8.7i in the market?

jake

[Samker]

Samker,

Is there a RTM version of the VSE 8.7i in the market?

jake

I find some new info:

VirusScan Enterprise 8.7i and Anti-Spyware Enterprise 8.7 released on September 26, 2008.  Minimum patch level for support is any Patch released in the last 12 months.

http://www.mcafee.com/us/small/support/customer_service/end_life.html

My Products - Download Software

Use your McAfee Support grant number to login and download new software, upgrades, maintenance releases, and documentation.

    * Login

Recent releases

    * McAfee Email & Web Security Virtual Appliance
    * McAfee Endpoint Encryption Build 5600
    * McAfee Network Access Control 3.0
    * McAfee Network Security Platform (formerly IntruShield) 5.1
    * McAfee Policy Auditor 5.0
    * McAfee VirusScan Enterprise 8.7
    * McAfee VirusScan Mobile Enterprise 2.0
    * McAfee VirusScan Enterprise for Offline Virtual Images

http://www.mcafee.com/us/medium/downloads/


It's look like they offer v.8.7 for Corporate User and also like FREE upgrade for current costumers.... but I'm not sure 100% about this. 

[georgecloner]

Samker,

Is there a RTM version of the VSE 8.7i in the market?

jake

I find some new info:

VirusScan Enterprise 8.7i and Anti-Spyware Enterprise 8.7 released on September 26, 2008.  Minimum patch level for support is any Patch released in the last 12 months.

http://www.mcafee.com/us/small/support/customer_service/end_life.html

My Products - Download Software

Use your McAfee Support grant number to login and download new software, upgrades, maintenance releases, and documentation.

    * Login

Recent releases

    * McAfee Email & Web Security Virtual Appliance
    * McAfee Endpoint Encryption Build 5600
    * McAfee Network Access Control 3.0
    * McAfee Network Security Platform (formerly IntruShield) 5.1
    * McAfee Policy Auditor 5.0
    * McAfee VirusScan Enterprise 8.7
    * McAfee VirusScan Mobile Enterprise 2.0
    * McAfee VirusScan Enterprise for Offline Virtual Images

http://www.mcafee.com/us/medium/downloads/


It's look like they offer v.8.7 for Corporate User and also like FREE upgrade for current costumers.... but I'm not sure 100% about this. 

That is SMB Edition for Corporate users. Have tried it "once" it is not beta release but I was not satisfied with its performance, somehow there is a glitch (maybe) in some process which eats out CPU usage.

Since no patch was available for 8.7, I have to reinstall 8.5i along with its patches in which I am completely satisfied.

By the time McAFee issued a patch for the 8.7 I really never ever been bother to promote my McAfee. Fortunately, I was right. 

I don't know what really was with McAfee, they have informed their subscribers with the release of this patch but never had it published available for download in products download and support. 

[georgecloner]

SCFORUM team would like to encourage users posts their problems in this thread with the 8.7 patch!

We will be glad to hear and likewise be of HELP!

We need to know if Windows system files were actually deleted or was it a corrupted registry. And how did you addressed the problem.

From McAfee Forum:

It was reported that network connection loses frequently; after users shutdown workstations, Windows will fail to boot.

Some McAfee users suggests to unistall the patch by creating an uninstall program with the package that does:
msiexec /x "patch1.msp" /qn

With some patches you have to change the "Uninstallable" DWORD to 0 in the Windows installer hive.
Otherwise you will not be able to uninstall the patch.

[davep]

Yea, I installed 8.7i on two PCs before I realized it was making them both crawl. 
Reinstalled 8.5i