#158986 - 2006-03-14 03:31 PM
Mcafee does it again...
|
Radimus
Moderator
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
http://www.computerworld.com/securitytopics/security/story/0,10801,109525,00.html?source=NLT_AM&nid=109525
News Story by Jaikumar Vijayan
MARCH 13, 2006 (COMPUTERWORLD) - A faulty antivirus update from McAfee Inc. that mistakenly identified hundreds of programs as a Windows virus has resulted in some companies accidentally deleting significant amounts of data from affected computers.
The McAfee update (DAT 4715) released on Friday was designed to protect computers against the W95/CTX virus. But because of a programming error, the update also incorrectly identified renamed and quarantined hundreds of legitimate executables including popular ones such as excel.exe, lsetup.exe, uninstall.exe, shutdown.exe and reg.exe.
For companies that had configured their McAfee antivirus program to automatically delete bad files, the error resulted in the loss of hundreds, and in some cases even thousands, of files on systems in which the update had been installed, said Johannes Ullrich, chief technology officer at the SANS Internet Storm Center (ISC) in Bethesda, Md.
|
|
Top
|
|
|
|
|
#158989 - 2006-03-14 04:47 PM
Re: Mcafee does it again...
|
Richard H.
Administrator
Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
|
Quote:
I laughed like mad when I read that earlier today. We have som customers that uses the ePO-server and mcafee av-client.
We didn't laugh. Not at all.
You would have thought that the fix would have included a patch to put automatically put back all files that had been incorrectly quarantined, but considering how badly they screwed up the DAT files maybe that's not such a good idea.
Fortunately the error only occurred in the "on demand" scan and not the "on access" check, and (in our case) the files were quarantined and not deleted. In the end of our ~2000 desktops only ~20 were damaged.
This sort of school-boy error should have been picked up with even the most basic of QA processes.
|
|
Top
|
|
|
|
|
#158991 - 2006-03-14 05:40 PM
Re: Mcafee does it again...
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
We had 103 computers affected. They did provide an Undo program to repair quarantined files, but we have default actions set to Clean/Delete.
I am curious what mcAfee customers thought of the 4715 response document that described the issue and the steps McAfee will be taking to prevent future issues such as this.
|
|
Top
|
|
|
|
#158997 - 2006-03-16 04:33 PM
Re: Mcafee does it again...
|
AndypB
Lurker
Registered: 2005-10-18
Posts: 2
|
We use EPO Server with auto updates and suffered no problems! We were lucky, our EPO server downloads new DAT updates @06:00 every morning and by that time 4716 was already released.
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 641 anonymous users online.
|
|
|
