Log in

View Full Version : Botched McAfee update shutting down corporate XP machines worldwide



stman
04-21-2010, 11:37 PM
Botched McAfee update shutting down corporate XP machines worldwide
By Nilay Patel posted Apr 21st 2010 1:47PM
From engadget.com
Breaking News

We're hearing from all over that a bad McAfee for Windows XP update is causing computers worldwide to shut down. Apparently DAT update 5958 deletes the svchost.exe file, which then triggers a false-positive in McAfee itself and sets off a chain of uncontrolled restarts and loss of networking functionality. Yeah, wild -- Twitter is basically going nuts, and McAfee's support site appears to be down. There are some fixes floating around out there, but it may be too late -- the final tally of borked PCs today may reach into the millions. We've already heard anecdotally that an Intel facility has been affected, as well as Dish Network call centers, and we're sure there are going to be more reports as the day wears on.

Update: McAfee just sent us a statement -- they've pulled the update from their corporate download servers, and consumers shouldn't be affected.

McAfee is aware that a number of customers have incurred a false positive error due to incorrect malware alerts on Wednesday, April 21. The problem occurs with the 5958 virus definition file (DAT) that was released on April 21 at 2.00 PM GMT+1 (6am Pacific Time).

Our initial investigation indicates that the error can result in moderate to significant performance issues on systems running Windows XP Service Pack 3.

The faulty update has been removed from McAfee download servers for corporate users, preventing any further impact on those customers. We are not aware of significant impact on consumer customers and believe we have effectively limited such occurrence.

McAfee teams are working with the highest priority to support impacted customers and plan to provide an update virus definition file shortly. McAfee apologizes for any inconvenience to our customers

Ouch -- that might be the understatement of the year. We've definitely hearing this affects SP2 as well, we'll keep looking for more.

Update 2: The anecdotal numbers keep rolling in, and they're not small -- 30,000 machines are knocked out here, 60,000 there. Given that the only fixes right now involve techs spending time with each affected machine individually, things could get seriously messy. We'll keep you updated if you keep us updated, okay?

Update 3: Here's an official McAfee fix, although like we said, it requires tech to hit each machine in person. We'll see what the story is for bigger institutions with tens of thousands of seats.

Update 4: We're told the official fix only helps those who haven't been hit with the bug yet, so there's obviously still issues to be sorted out.

OddJob
04-22-2010, 02:20 AM
http://i40.tinypic.com/2lsd0r9.gif

If your computer is shutting down automatically, you must address that
before you can fix anything else.

Step 1: Open a command prompt: Start menu, Run, then type cmd and hit
Enter
Step 2: Type shutdown -a, which will prevent the shutdown from occurring

McAfee has revealed two fixes for the problem. Each one requires multiple
steps, and can be confusing. If you're not comfortable with advanced
computer fixes, you should get help with this.

For the first fix, go to the McAfee interface through the Start menu, and
disable Access Protection and On-Access Scanner.

Step 1: Click Start, Programs, McAfee, and then VirusScan Console
Step 2: Right-click "Access Protection"
Step 3: Select "Disable"

If you have Internet access, download the EXTRA.ZIP file provided by McAfee
and unzip the EXTRA.DAT within. (Note that Nai.com is a safe site maintained
by McAfee, for those who were wondering.) Once EXTRA.DAT has been
extracted:

Step 1: Click Start, Run, then type services.msc and click "OK"
Step 2: Right-click the McAfee McShield service and select "Stop"
Step 3: Copy EXTRA.DAT to "\Program Files\Common Files\McAfee\Engine"
Step 4: Then restart the McAfee McShield service by right-clicking on it and
choosing "Start" from the context menu
Step 5: Re-enable access protection by going back to the VirusScan Console
Step 6: Right-click "Access Protection"
Step 7: Select "Enable"
Step 8: In the VirusScan Console, go to the Quarantine Manager Policy
Step 9: Click the Manager tab
Step 10: Right-click on each file in the Quarantine and choose "Restore"

There is, of course, one massive hang-up with this McAfee-recommended
solution: More likely than not, you don't have Internet access on your
McAfee-borked computer. In fact, it's highly unlikely that you have access to
much of anything, since deleting SVCHOST.EXE prevents key Windows 32-bit
sub-system processes from functioning at all. To get the EXTRA.DAT on you
computer, you'll probably have to download it on an unaffected computer,
then copy it to either a USB drive or a CD-ROM and use the command prompt
to copy it over to your C: drive.

The second workaround requires that you apply the EXTRA.DAT fix as detailed
above before beginning and that you have access to a second, unaffected
Windows XP computer. On that computer, go to C:\WINDOWS\system32 and
copy SVCHOST.EXE to a network location or a removable media device such
as a USB stick. Then copy the SVCHOST.EXE from the unaffected computer
to the affected computer, and restart the McAfee-afflicted computer. There
are details on applying the EXTRA.DAT via ePolicy Orchestrator at McAfee's
fix on Nai.com.

Severe problems caused by buggy or false positive security updates are rare,
but not unheard of. Recent instances include an update from Avast that
marked hundreds of legitimate files as threats in December 2009, Computer
Associates flagging a Windows system file as a virus in July 2009, and AVG
marking ZoneAlarm as malware in October 2008.

McAfee has not immediately responded to a request for comment.