Kaspersky Update Breaks Internet Access For Windows XP Users 92
An anonymous reader writes "Yesterday afternoon, Kaspersky Labs released a definition update that blocked all Internet and Intranet access on Windows XP workstations. While there has been no official communication from Kaspersky, their forum is lit up with angry customers relying on each other to find a fix."
Update: 02/05 16:42 GMT by T : Thanks to an anonymous reader, who says that Kaspersky has issued a statement, and a fix (though the fix takes some manual labor to implement).
let me guess (Score:5, Funny)
Actually, they don't. (Score:3)
Right now, the "temporary" fix is to disable their Web AV.
Re: (Score:3)
At least you can do that. I had a mate that installed McAffee (because it came bundled with BT's broadband package). His machine refused to connect to the internet, though ICMP packets were allowed. My first thought was "Disable everything that even resembles McAffee", but to no avail. In the end I did what I should have done initially - wipe every mention of McAffee from the machine - job done. I still don't know what was blocking the traffic.
Re: (Score:1)
In the end I did what I should have done initially - wipe every mention of McAffee from the machine - job done.
Same strategy that the nation of Belize used. Worked pretty well for them too.
Re: (Score:1)
Re: (Score:2)
What I was trying to say was that at least in this case you can disable the Kaspersky components so you can connect to the internet to download the update without resorting to sneakernet.
Link to fix (Score:5, Informative)
http://forum.kaspersky.com/index.php?showtopic=255508&st=20&p=1978848&#entry1978848 [kaspersky.com]
Text of fix, credit the forum poster known as "omaudio":
from Kaspersky-
"We apologize for the inconvenience. It does appear that there was a hiccup with an Update pushed out causing Windows XP machines to lose internet connectivity. An update was just released that should address the issue, what I will need you to do is:
To get XP users internet connectivity (temporarily), please disable the Web AV component of your protection policy for your managed computers. After doing so;
In Security Center (or Admin Kit):
1.) Go to the Repositories section >> (Right click) Updates >> All Tasks >> Clear updates repository.
2.) Go to the Repositories section >> (Right click) Updates >> Download Updates
After taking this step, please run your group Update task for Managed Computers. After the update has been pushed to your workstations, please re-enable your Web AV component in your protection policy. This should resolve the issue. "
Fix is right there on the internet (Score:3)
So, they broke internet access, but it's ok, because you can download the fix from the internet.
That reminds me of the failure of the Russian Phobos-1 mission, which occurred when they sent an (incorrect) command stating, roughly, "point the receiving antenna away from the Earth, and wait for further instructions."
* (greatly simplified)
Comment removed (Score:3)
We don't need no stinkin' testing... (Score:2)
I'll bet they don't even have an XP machine to do the testing on. Besides, if they did, would they be having problems with it...?
Re: (Score:2)
With Windows XP, not having access to the internet might be the most secure option. The only way I usually run XP is on a virtual machine with the networking turned off, so Windows doesn't even know the internet exists (just like early Windows 95).
Re: (Score:2)
Re: (Score:2)
Er, I don't think anyone would be irresponsible enough to release official builds even for a minor open source project without having a set of VMs, one with each major supported version of Windows. There's usually something wrong. Like, in Dungeon Crawl [develz.org] (not so minor a project, but not big either), Windows builds for 0.11.0 worked fine, 0.11.1 would crash on startup on Win7 (but not XP, 2k or 8) if I didn't catch it, 0.11.2 built fine again. Quite puzzling -- why would a strictly bugfix point release sud
Re: (Score:2)
When you have millions of customers and no two have identical machines, it's damned hard to test for every case. It doesn't say if all XP machines are affected (which should have been tested for) or if just a large number of them have been (which may or may not have shown up in testing).
Re: (Score:1)
Re: (Score:2)
Re: (Score:3)
That covers the hardware, which is mostly irrelevant to anti-virus other than how long it takes to scan. What service pack is installed? What patches? Hotfixes? Third party programs? What malware is on there? What files are corrupt? What settings has the user changed? Is it Home or Pro? Once an XP machine has a year or two since the last OS reinstall, there's thousands of variables. Once an XP machine has four or five years with an average user, it's almost unrecognizable.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Re:In Soviet Russia... (Score:5, Funny)
Re: (Score:2)
I thought in that case, the viruses scam you.
Re: (Score:2)
I thought in that case, the viruses scam you.
No, that's what happens everywhere. Not just soviet Russia.
Strong Protection (Score:2)
Re: (Score:1)
That was my thoughts as well. Considering XP could be 0wned in an average of four minutes, it suggests that old XP is just not safe on the Internet. (XP with service packs and built-in firewall is apparently fine.)
Isn't that the goal? (Score:5, Funny)
To be the perfect AV ......
No internet means
No virus
No Botnet
No Adware
No Spyware
Or maybe the program became self aware and realized that the internet is a disease, a virus, needing to be squashed
Re:Isn't that the goal? (Score:4, Interesting)
You may laugh, but originally that was the only way for Windows NT to get C2 certification. :-)
* http://support.microsoft.com/kb/93362 [microsoft.com] ... It may be enough to consider networking to be another subsystem, ... "
" Microsoft has opted not to include certain components of Windows NT in the evaluation process,
Re: (Score:1)
Re: (Score:2)
Seems that AV software is a prescription worse than the disease.
I always though McAfee was akin to Thalidomide in that respect. It would appear that Kapersky is cut from the same cloth...
Is Norton Security Suite (or whatever it is/was called) still the ultimate cyanide pill for a well-configured system?
They are right (Score:1, Troll)
Cutting off internet access is one of the very best methods for Windows XP security. What's the problem?
Re: (Score:2)
Cutting off internet access is one of the very best methods for Windows XP security. What's the problem?
Reality. That is always the problem, and I know a lot of people here have difficulties with it.
Don't worry, they are already working on a fix (Score:5, Funny)
The next update will fix the issue, you'll just have to download it...oh, wait.
Re: (Score:2)
Good question - ASSuming that the XP box is the only box they own, how can they discuss their problem on an internet forum? It's not like XP owners are likely to live near a library, or have a relative, or an internet cafe nearby. None of them live near a campus with internet access. Geeez, this is an insurmountable problem, isn't it? Unless, of course, someone actually does backups, and restored his system to a pre-update status.
Phhhht - silly questions form silly AC's.
Re: (Score:2)
Good question - ASSuming that the XP box is the only box they own
No, it's a terrible question. Your assumption is incorrect. And most of them probably have an internet-capable smart phone. Wake up, it's the 21st century.
Good Guy Kaspersky (Score:3)
Protecting users of more up to date Windows versions from those malware infested botnet-targets.
Re: (Score:2)
Thus (Score:2)
Thus making Windows XP completely secure!
Re: (Score:2)
Thus making Windows XP completely secure!
Sadly, it merely disabled user web surfing (HTTP traffic) to allow the malware on your PC full access to your internet bandwidth... ;^)
No need for that pesky user web surfing tying up your pipe when you have a botnet to manage...
When does AV become more risky than the virus? (Score:5, Interesting)
I have to wonder at which point workstation AV software becomes a bigger risk than the actual malware.
So far in our organization, we've had two AV incidents. One several years ago when a user brought in an infected laptop with one of the Microsoft RPC exploiting worms. We got the worm before the AV vendor (Symantec at the time) had a signature for it, so the AV software was totally useless. The other event was when Symantec erroneously flagged a Windows Server 2003 resource kit program as malware and quarantined it (fortunately, a program we didn't rely on). So so far, for us - AV has failed to catch our only malware infection and has broken a non-infected program. Strict filtering (both inbound AND outbound) has done a lot more to stop malware in our organization than AV software ever has.
I also remember an incident a few years ago when a prominent AV vendor's software (I think it was Norton) erroneously quarantined a system file in the Chinese version of WinXP, and rendered the workstation unbootable, affecting a very large number of users.
I also wonder if any of the AV companies have independently verified and verifiable procedures for making their updates; a malicious employee at one of the big AV vendors could cause a lot of damage by releasing an update that results in an important system file getting quarantined. What safeguards do each AV vendor have in place to prevent this happening? How is it verified that the companies are actually carrying out the policies if they have them to ensure updates are not malicious, and how is it verified that these policies are actually watertight?
Re: (Score:1)
To some extent, that kind of verification is market driven.
If somebody blows it too many times, or if someone else discovers that an AV package has become malicious, that vendor's reputation will be impacted, and reputation is a very big part of who gets the big money in the AV game.
Also, did you check the AV logs from all of your organization's workstations before claiming that the stuff has been useless?
Re: (Score:2)
Windows Update in Vista and newer sometimes does the same thing if there is an update for the wireless card (especially Atheros) in optional updates.
How about that? "I can see an update for your wireless card. Let me disable all internet access for you!"
Disabling WU may not help. Instead remove the Atheros card in device manager, reboot, go online and get the latest driver (your card should now show as a Qualcomm device in dev man).
I've started doing this on all atheros wifi cards as a preventive measure.
"There has been no official communication..." (Score:5, Funny)
there has been no official communication from Kaspersky
It seems they were using Windows XP.
Comment removed (Score:5, Funny)
Re: (Score:3)
LOL the first link I found was a w3schools one where apparently 1/5 of wanna-be web developers were using XP as of two months ago. Its been dropping about 10% per year for several years now, so that will sunset around 2016 or so.
If a fifth of the techno-elite (LOL) are using XP I think in the wider market the numbers must be 50% or so.
I know MANY megacorps still stuck on XP. There are huge issues with being unable to give a "better" computer to a "lower" status employee that really screw up rollouts, not
Re: (Score:3)
Place I used to work had a knee-high pile of Compaq 386 laptops sitting in the radio room. I offered to surplus them and the radio guys
Re: (Score:1)
Re: (Score:2)
Re: (Score:3, Insightful)
Not the first time (Score:2)
Not the first time a KAV update has broken something. KAV for Exchange has had several updates come out that stomped on Store.EXE and kept it from running at all without uninstalling KAV for Exchange.
Client-side breakage seems less common, but unless you're running an SSD RAID-10 disk system with an 8 core CPU, you're always wise to dial back some of the Kaspersky defaults or you will find your machine unusable.
It also helps to reduce the frequency of updates. The default is something ludicrous like ever
It's not just with WinXP. (Score:3, Interesting)
Re:It's not just with WinXP. (Score:5, Funny)
I had to physically remove its folder from the Program Files area...
I just got this mental picture of someone opening up their hard drive and scraping a section off one of the platters.... :)
Re: (Score:1)
Re: (Score:2)
Okay, on reflection maybe I should not have used the adverb 'physically'. But I did have to remove the Kaspersky folder from the Program Files. Otherwise the install program would crash while reinstalling the software.
You should have stuck with the ever-popular "literally" [xkcd.com]
Re: (Score:2)
I had to physically remove its folder from the Program Files area...
I just got this mental picture of someone opening up their hard drive and scraping a section off one of the platters.... :)
Oh, you're not supposed to do that when you delete something? No wonder I get through so many hard drives.
Then that means that.... (Score:1)
Re: (Score:2)
They shouldn't have fixed it. anyone using Windows XP should have upgraded years ago. Perhaps this would be encouragement to move to Windows 7....or Linux :D
Some applications still need Windows XP. Yes the applications should have been designed better.
Re: (Score:1)
Then stop using shitty apps?
Re: (Score:2)
They shouldn't have fixed it. anyone using Windows XP should have upgraded years ago. Perhaps this would be encouragement to move to Windows 7....or Linux :D
Anyone who wanted to move to Linux has been perfectly free to do so for years.
Windows 7 requires a higher spec to run than XP, so a lot of people who are perfectly happy running an old 600 MHz Pentium 3 laptop with 128mb memory on XP probably aren't going to be able to upgrade to Windows 7.
Re: (Score:1)
Like I said, they needed to upgrade a decade ago. Turn that old P3 into a linux server and buy a new machine FFS. Tax time is here, spend 300 bucks and get a better machine.
Wait a second...... (Score:1)
Re: (Score:2)
Because Kaspersky catches a lot more nasties than Microsoft Security Essentials. And I mean a LOT more.
Re: (Score:2)
...in corner cases, not against real-world data.
"According to Microsoft, although AV-Test’s results indicated that Microsoft’s antivirus products detected only 72 percent of all “zero-day malware,” Microsoft knows from its telemetry data—from hundreds of millions of systems around the world—that fully 99.997 percent of its customers hit with any zero-day attack did not in fact encounter the malware samples tested in this test (basically a 100 percent success rate in the r
Re: (Score:2)
Think about what Microsoft is saying here. All MS is saying is that the sample was too small.
What Microsft is saying is that an unknown number of Microsoft customers was hit with some kind of zero-day attack. It doen't equate to a 100% success rate in real life, it says nothing about MSE's success rate in catching zero day attacks. All it says is that the sample size of zero-day attacks was too small for meaningful analysis.
Re: (Score:3, Funny)
Rollout to 12k PCs...and breaks them.... (Score:2)
Test better (Score:2)
Kaspersky - I need this probably as much as I need another hole in the head.
Thanks,
Your customer
Not Just Internet Access (Score:2)
And Finally (Score:2)
I'm trying and trying... (Score:2)