Forgot your password?
typodupeerror
Bug Windows IT

McAfee Kills SVCHost.exe, Sets Off Reboot Loops For Win XP, Win 2000 472

Posted by timothy
from the hope-you-were-using-antiantivirus-too dept.
Kohenkatz writes "A McAfee Update today (DAT 5958) incorrectly identifies svchost.exe, a critical Windows executable, as a virus and tries to remove it, causing endless reboot loops." Reader jswackh adds this terse description: "So far the fixes are sneakernet only. An IT person will have to touch all affected PCs. Reports say that it quarantines SVCHOST. [Affected computers] have no network access, and missing are taskbar/icons/etc. Basically non-functioning. Windows 7 seems to be unaffected." Updated 20100421 20:08 GMT by timothy: An anonymous reader points out this easy-to-follow fix for the McAfee flub.
This discussion has been archived. No new comments can be posted.

McAfee Kills SVCHost.exe, Sets Off Reboot Loops For Win XP, Win 2000

Comments Filter:
  • shutdown -a (Score:5, Informative)

    by bugs2squash (1132591) on Wednesday April 21, 2010 @02:14PM (#31927586)
    at a command prompt when the "windows will shut down in XX seconds" popup us on screen saved me. I'm still waiting for a mcafee update file to fix it properly.
  • by buddyglass (925859) on Wednesday April 21, 2010 @02:18PM (#31927678)

    Seriously. They consume CPU. They stay resident and consume usable memory. They occasionally crash and/or cause other applications not to work. And, in this situation, they break Windows. I don't use AV and have had pretty much zero issues over the last 6 years of using Windows XP. All you need to do is:

    * Configure Windows update to run daily.

    * Don't use IE or Outlook.

    * Keep Windows Firewall active.

    * Don't connect directly to the internet- sit behind a router that's configured to be (mostly) invisible.

    * Don't run random things you get sent in email, on facebook, or that pop up unexpectedly while you're at a questionable website.

    * If you think something's amiss, boot into safe mode and use a non-resident tool like MBAM.

  • by DjMd (541962) on Wednesday April 21, 2010 @02:27PM (#31927912) Journal
    http://isc.sans.org/diary.html?storyid=8656 [sans.org]
    Basically it looks like command line

    shutdown -a (to stop the autorestart)

    Put SVChost.exe back in place (out of the quarantine )

    and disable McAfee...

  • My Experience (Score:5, Informative)

    by jibster (223164) on Wednesday April 21, 2010 @02:29PM (#31927994)
    I work at a major chip manufacturing plant. At 4.10 I was conferencing with another fab when all our PCs shutdown. 10 minutes later the place was in chaos. Now don't get me wrong the fab keeps going but my god the cost to the company of this. Say 10 sites world wide with 2-5k employees each the majority of which can't do any meaningful work. McAfee have a lot to answer for.
  • by 2names (531755) on Wednesday April 21, 2010 @02:33PM (#31928068)
    Every system that we had that was XP SP3 that got updated to the 5958 DAT file became useless. We are now forced to visit each machine and manually fix it. Rubbish.
  • Re:Black Wednesday (Score:1, Informative)

    by GNious (953874) on Wednesday April 21, 2010 @02:34PM (#31928106)

    True, but business needs dictate software requirements. So that decision is out of my hands (but believe me, I'd LOVE to run an office full of Linux computers)...

    Interesting.
    We're forced to use Windows on Dell laptops, though I can see no business needs for it, nor any technical requirements (SaaS suites are used, and our various applications are almost all running on some Unix derivative). Our Exec team are all using OSX, showing that non-techies are quite able to do their business without Windows. Even then, there is no way in hell we'll get away from Windows, and almost as little chance we'd get away from Dell even if everyone in Internal IT hates Dell.

  • by zonky (1153039) on Wednesday April 21, 2010 @02:35PM (#31928122)
    There is no such thing as a reputable site on the internet.
    Some sites use ad networks, which have happily served malware.
    Other sites are run by clueless admins and left vulnerable to commodity exploits.

    Drive by Downloads exist, and a risk everywhere.
  • by blincoln (592401) on Wednesday April 21, 2010 @02:36PM (#31928154) Homepage Journal

    I used to believe something along those lines. Then my PC was infected with a worm when I plugged an mp3 player into the USB port. I'd bought the player new, factory-sealed, so it must have picked it up at the manufacturing plant. I disabled all autorun/autoplay after that, but I'm still wary enough that I run Avast to help avoid another similar situation.

    Also, none of the things you mention will detect/remove a rootkit if one does manage to make its way onto your PC. I cleaned one up off of a PC that belongs to my sister a few weeks ago, and that was a headache. I did a scan of the infected drive in an external USB case, and that got nearly all of the infected files taken care of, but because most virus scanners apparently don't scan the MBR of non-boot drives, the rootkit was still waiting there and I had to use the Windows recovery console to write a new MBR.

    As far as I can tell, her PC was infected through some variation of the "malicious PDF in a hidden IFRAME which belongs to an online advertisement" scenario, because she was already using Firefox exclusively. So maybe you should at least add "don't install Adobe Reader, or if you do, disable browser integration, update it daily, and set Firefox to download PDFs instead of opening them" and "install and use AdBlock Plus, and possibly NoScript" to your list.

  • by diverman (55324) on Wednesday April 21, 2010 @02:38PM (#31928188)

    I agree that it raises question as to why one should use them, but "down time" is not the biggest threat out there, if you wanna talk loss/cost. While one's time is valuable, I'm thinking that their bank account information, passwords, etc, might be slightly more valuable to them. Personally, I think good secure end-user practices is the best protection, I do think that a good A/V program is needed.

    So, while there is malware out there that is less harmful, more of the malware out there is much MORE harmful... if you disagree, please provide your financial account information, or contact me to transfer all funds to a secured off-shore account... maybe buy me a new car too! ;-)

    But seriously... this is really bad, and REALLY stupid. But having no protection for most users risks damaging them in ways worse than a few hours of time to manually fix their issue. And from a corporate perspective, loss of sensitive information is a BIG deal and can cost a LOT more. And that's just talking about data loss. Being part of a botnet to help facilitate financial fraud and other badness... that's also double plus ungood... and irresponsible to not take measures to help keep your computer from playing a part in those crimes.

    Anyway... I agree it raises question... but there more downside to malware than just downtime.

  • Re:Double ouch. (Score:5, Informative)

    by Jazz-Masta (240659) on Wednesday April 21, 2010 @02:40PM (#31928246)

    Norton, McAfee and Trend Micro have very solid products that allow for remote management, deployment, updates, forced scans, etc.

    Avast (which I use at home) does not have all of these features yet. I can tell you that when dealing with hundreds of machines, having that dashboard for antivirus saves many hours of time. You can run more frequent scans on problem machines, or allow more/less freedom with the click of a button. Many of the products also have URL blocking (by category), email attachment filtering through Exchange plugins, etc. One feature I like about Trend Micro is the "behaviour" plugin, which flags anything out of the ordinary - such as accessing files, programs, or drives that they haven't before.

    Corporate networks also typically have edge firewalls that will catch many of the malware infested URLs, email attachments, etc that cause problems. For many businesses 200+ computers, the Windows-installed Anti-virus software is actually the last line of defense. Often times the loss of productivity of a couple viruses getting through isn't worth the extra $$ invested in more products or a "better" product with less management features.

    Licencing is also a plus. While Norton, McAfeee and Trend Micro are expensive initially, additional licences for a large number of computers and renewal licences each year actually make it less expensive than others such as Avast and Panda.

  • by kwandar (733439) on Wednesday April 21, 2010 @02:44PM (#31928358)
    We have hundreds of systems down. We were looking at Avira in any event as it was lighter, but now we are moving there at warp speed. Mcaffee's quality assurance really screwed up on this. Major problems worldwide.
  • Marketing (Score:3, Informative)

    by Andy Dodd (701) <atd7@NosPaM.cornell.edu> on Wednesday April 21, 2010 @02:47PM (#31928426) Homepage

    Subject line says it all...

  • by UnknowingFool (672806) on Wednesday April 21, 2010 @02:50PM (#31928558)
    Svchost has been around forever. It basically encapsulates other applications. Svchost handles many things from DCHP client to Windows Themes. The problem is that McAfee doesn't seem to discriminate between any of them in this case. Which would cripple any XP system today.
  • by Sandbags (964742) on Wednesday April 21, 2010 @02:52PM (#31928604) Journal

    Additionally,

    * Don't click on links without verifying the actual link matches the name displayed in HTML when you mouse over it. When in doubt, type the root URL in by hand and browse to the specific page.

    * Don't read spam. Anything anyone sends you, even family members, providing you with news, alerts, health related info, virus warnings, saftey warnings, etc, is ALL bullshit. HaoxBusters and snopes.com are your friends, when in doubt, LOOK UP the email there, and then tell your friend/family member to check themselves next time or risk being blacklisted. (I actually created a default reply script so when a family member sent me something that looked fishy, i ran a script that made a fairly convincing looking e-mail that would appear to come from a security server indicating the content of thier e-mail was blocked as it was known SPAM and may contain a virus, took a few months and they ALL stopped sending me crap...)

    * Don't download and install anything unless its direct from a nationally known vendor and its a product sold commercially (or a known safe FOSS vendor). If it's not sold on a shelf in a store, ask yourself why not? Clearly, if it was a legit product, it should be... (yes, I know, many perfectly acceptable FOSS packages out there. in that case a good rule of thumb is that If 3 PC literate people you know can't name it, its not safe).

    * ignore all adverts, block them if you can

    * Don't use any account with admin privileged unless you're doing something at that moment that requires it.

    * Use strong passwords, and use a DIFFERENT ONE on EVERY site. There are lots of tricks for coming up with good passwords, and for remembering which one is for which site.

    * only sign up for what you have to; don't enter contests, marketing programs, or provide email addresses or phone numbers of your primary accounts. Some web sites insist on sending you an e-mail to validate an account ID: use a special, separate email account just for that, and immediately change any password they may issue you in that e-mail.

    * never give out your personal/primary email address to a company or someone you do not personally trust for any reason.

    * stay off P2P and other sharing systems completely.

    * there's not just AntiVirus software, there's also AntiSpyware software, USE BOTH!

    * Back up regularly, to a drive that is NOT always connected to your system (leaving a backup USB drive or network share mounted all the time means a virus can wipe out your backups too!) back up stuff you want to save from fire and other disasters online to a secure hosted system.

    * When browsing questionable sites, do so from a virtual machine or a machine that uses completely different account information from your primary accounts and contains none of your personal files. A cheap old laptop is a good solution for that).

  • by Animats (122034) on Wednesday April 21, 2010 @03:18PM (#31929180) Homepage

    The story just hit ABC News, via the Associated Press: "McAfee Antivirus Program Goes Berserk, Reboots PCs" [go.com] There are stories on the Huffington Post and NextGov. The story just broke into mainstream news in the last hour. It just hit the New York Times.

    There's nothing on McAfee's home page about this yet. No items in their "News" or "Threat Center" or "Breaking Advisory" sections. There's supposedly a McAfee Knowledge Base article, "False positive detection of w32/wecorl.a in 5958 DAT" [mcafee.com], but their knowledge base site is overloaded. When it eventually loads, there's a download link to a patch. But there's nothing like an apology. All they say is "Problem: Blue screen or DCOM error, followed by shutdown messages after updating to the 5958 DAT on April 21, 2010."

    McAfee has botched their damage control. They should be out there apologizing. Meanwhile, you can watch McAfee stock drop. [yahoo.com]

  • Anonymous Coward (Score:1, Informative)

    by Anonymous Coward on Wednesday April 21, 2010 @03:20PM (#31929226)

    Yup - My contacts at Intel say they are down accross the board - more accuartely across the world (thats over 110,000 workstations folks). Employees are being advised to use their laptops and to make sure that they are not plugged into the network.

  • Thank god.... (Score:2, Informative)

    by FunPika (1551249) on Wednesday April 21, 2010 @03:25PM (#31929348) Journal
    Comcast decided to start providing Norton instead of Mcafee to its customers.
  • Our fix method (Score:1, Informative)

    by Anonymous Coward on Wednesday April 21, 2010 @03:33PM (#31929538)

    Our fix method is as follows:

    Download the extra.dat file from http://download.nai.com/products/mcafee-avert/wecorl/extra.dat and put it on your favorite removable media.
    Reboot into safe mode.
    Control-Shift-Esc to access Task Manager.
    File, Run, cmd to access Command Prompt.
    Copy extra.dat to C:\Program Files\Common Files\McAfee\Engine
    Copy C:\windows\system32\dllcache\svchost.exe C:\windows\system32 (and overwrite).
    Reboot into regular mode.

  • I have to wonder... (Score:3, Informative)

    by Alioth (221270) <no@spam> on Wednesday April 21, 2010 @03:37PM (#31929630) Journal

    I have to wonder what controls the various AV companies have to prevent a malicious signature be inserted - for example, someone deliberately doing something like this (but hitting all versions of Windows).

    It's not just McAfee that's had this particular style of false-positive problem - Symantec also falsely identified a legitimate part of the Windows 2003 Server resource kit as malware. Fortunately in Symantec's case the damage was very limited.

  • by CountZer0 (60549) on Wednesday April 21, 2010 @03:48PM (#31929832) Homepage

    I work in the financial industry, and this issue caused significant disruption to trading floors throughout Wall Street. Traders are generally quite upset with McAfee right now, so it makes sense that their stock is dropping :)

  • Re:Sigh... (Score:3, Informative)

    by CTalkobt (81900) on Wednesday April 21, 2010 @03:52PM (#31929888) Homepage
    The first post was posted at 2:03pm (in my timezone) .. yours was posted at 2:07 so all things considering, a 4 minute fix isn't too bad...
  • by Anonymous Coward on Wednesday April 21, 2010 @03:52PM (#31929902)

    "I disabled all autorun/autoplay after that, but I'm still wary enough that I run Avast to help avoid another similar situation."

    Yes to disabling autorun. That's the vector for the only worm I've seen in 10 years of running XP in the way the previous post described (it came in on a USB flash drive). So, add to his list:

    * Disable autorun/autoplay correctly [us-cert.gov] (note: Microsoft's advice will NOT kill it off completely).

    * Run something lightweight like StartupMonitor [mlin.net] to catch programs that try to install things in the various startup locations (useful to control bloatware too)

    And something else I've done:

    * make a fake, read-only AUTORUN.INF directory on usb flash drives and other portable devices so that when a worm tries to write on there, the filename already exists and it fails. So far I've not seen any worms smart enough to look for pre-existing files and delete them before attempting overwriting, and by making it a directory with that name the deletion process is more complicated.

  • Re:shutdown -a (Score:3, Informative)

    by cryogenix (811497) on Wednesday April 21, 2010 @04:19PM (#31930348)
    The updated dat is available now, an updated extra.dat was available earlier this morning. I was the one that posted it in the tech support forums. You could have however just disabled access protection and on access scan to keep it from scanning at all. Not a great solution but at least your machine works. If your svchost.exe got nuked, copy it back from the system32\dllcache folder.
  • Plug-ins (Score:4, Informative)

    by DrYak (748999) on Wednesday April 21, 2010 @05:20PM (#31931528) Homepage

    ClamWin *itself* doesn't have an on-access scanner but...

    • External apps :
      • External packages clamsentinel [sourceforge.net] can automatically scan files upon modifications
      • And software packages like WinPooch [sourceforge.net] can, among other stuff, hook the "execute" and "open" OS' functions to scan files before accessing them.
    • Plug-ins :
      On the other hand, there are numerous plugins to hook clamwin to, so you can check for virus at their point of arrival.
      (On the client's side there are Firefox [mozilla.org] and Outlook plugins, on the server's side there are Samba plugins)

    but personally I supplement always ClamWin with a 2nd antivirus featuring a on-demand scanner.

    ClamWin&Plugins +Avira or +AVG.

  • by Animats (122034) on Wednesday April 21, 2010 @05:50PM (#31932026) Homepage

    Computerworld reports [computerworld.com] that McAfee has reacted to user complaints by shutting down their support forum. [mcafee.com] The forum seems to be back up now. That was an extremely dumb move to pull after the story was already in the New York Times, Business Week, and on TV.

    Many frantic users in the forum. The big losers are the enterprise users who bought into McAfee's premium services, with automatic corporate-wide updating. There's no fully automatic, reliable fix yet for systems already damaged. In some cases, it's apparently necessary to bring in a new copy of "svchost.exe"; the one in quarantine is bad.

    This points up a major risk to US computer infrastructure. Any program with remote update is potentially capable of taking down vast numbers of systems. Ones like McAfee or Windows Update, which deploy updates to all targets simultaneously, can cause widespread damage quickly. Remote updating by vendors may need to be regulated, as a public policy issue.

Uncompensated overtime? Just Say No.

Working...