-
McAfee automatic updating sucks, too
Posted on April 22nd, 2010 at 07:38 6 commentsIf you have McAfee Antivirus running on a Windows XP machine with Service Pack 3 installed, you probably can’t read this.
McAfee has removed the defective update, but I’m hearing estimates that tens of thousands – maybe hundreds of thousands – of PCs got locked up.
Wow. I can’t think of any virus in the history of malware that took out so many machines, so quickly, effectively, and thoroughly. The dead machines are locked up so tight it’s very hard to get them back and working: general approach seems to be disabling McAfee and re-installing svchost.exe. Ah well. Good riddance to bad rubbish, sez I.
The reason? A false positive. The virus definition update released earlier this morning mis-identified the WinXP SP3 system file svchost.exe as being infected with the W32/Wecorl.a virus.
Full details on the SANS Internet Storm Center (I’m having trouble getting into their server – they may be melting down at the moment).
For those of you who haven’t been listening, or reading my books, I’ll repeat it one more time. There’s no reason in the world to be paying for antivirus software. The mainstream packages have turned into big, bloated, pieces of clingy, begging junk. And that’s being charitable. You should use free antivirus, and my favorite at this moment is Microsoft Security Essentials. Fast, free, easy – and it won’t accidentally flag svchost.exe as an infected file.
I hope.
6 responses to “McAfee automatic updating sucks, too”
-
rc primak April 22nd, 2010 at 11:46
Yes, one advantage of MSE is that being from Microsoft, it is much less likely to flag Windows critical files as malware. Just about everyone else, even the free folks, has had at least one huge embarrassment within the past year or so. But if you believe in advanced heuristics protections, MSE does not have these yet.
-
In my household, one of our WinXP computers was spared because it still was running SP2. But another “updated” machine with SP3 was trashed. If we had *only* had the SP3 computer, I have no idea how we would have proceeded, since the fixes were posted online, and we needed a working machine to obtain them.
It’s probably true that MSE won’t treat an essential operating system file as a virus, but if that’s a compliment to Microsoft it’s a rather weak one.
-
rc primak April 23rd, 2010 at 11:32
Or in your household, OUCH!!
BTW, there are much stronger reasons to like MSE. See the more recent post about the VirusTotal AV camparisons, and follow the link. The chart is a bit small, but it can be enlarged by zooming in on it. Seeing is believing.
-
@Marty, the best way to update XP computers to XP SP3 level is to use an XP CD that already contains the SP3 files (aka. slipstreamed XP SP3). that way, you’ll have less problems with SP3. I’d never use the SP3 update from Windows Update; I always use either the full SP3 package or the integrated XP SP3 CD to install/update SP3.
Microsoft will be ending ALL support for WinXP SP2 on mid-July 2010. After that time, no more new post-SP2 security updates will be made and any new updates made after July 2010 will require XP SP3.
-
I would not be too certain about Microsoft Security essentials not trashing a system or other important file. A year or so ago, Windows defender incorrectly flagged a file (a dll file in a Windows directory as I recall?) as having a virus and fixed it by removing some code. After that Simply Accounting, which is probably Canada’s most widely used accounting software for small business could not be loaded. That is not as bad as trashing the system, but I think they all do and will make mistakes from time to time.
-
Marty said “It’s probably true that MSE won’t treat an essential operating system file as a virus”.
I have zero confidence, though, that MS won’t false flag competitors’ major essential programs. Who can forget when the Java coalition– roughly 135 companies producing Java Virtual Machine software– went to court to make Microsoft STOP producing MS’s own intentionally buggy version. “In its lawsuit filed [in 2002], Sun claimed that Microsoft was distributing “an obsolete implementation, ensuring that important advances in Java technology were unavailable to users. It asked the courts to order Microsoft to ship Sun’s current, compatible implementation.” (Microsoft considers Java a threat to MS dominance because Java’s aim is to make software easy to write in such a way that it runs identically on a variety of O/S platforms…thus reducing the learning curve that prevents Windows users from making the leap to Linux and Mac. MS’s “.Net” virtual machine is a direct competitor to Java, designed to provide most of the same functionality without Java’s promise of “write once, run anywhere”.)
Microsoft isn’t “into” fair competition. They are NOT above using F.U.D., embrace-extend-extinguish, and a suitcase full of other dirty tricks to dominate the marketplace. Intentionally sloppy and careless quality assurance would not be out of character in “security” software from Redmond. Don’t trust MS; continue to embrace other security software vendors– the ones with shorter rap sheets.
“Who will watch the watchmen?”
Leave a reply
-


