McAfee Kills SVCHost.exe, Sets Off Reboot Loops For Win XP, Win 2000 472
Kohenkatz writes "A McAfee Update today (DAT 5958) incorrectly identifies svchost.exe, a critical Windows executable, as a virus and tries to remove it, causing endless reboot loops."
Reader jswackh adds this terse description: "So far the fixes are sneakernet only. An IT person will have to touch all affected PCs. Reports say that it quarantines SVCHOST. [Affected computers] have no network access, and missing are taskbar/icons/etc. Basically non-functioning. Windows 7 seems to be unaffected."
Updated 20100421 20:08 GMT by timothy: An anonymous reader points out this easy-to-follow fix for the McAfee flub.
shutdown -a (Score:5, Informative)
virus scanners are the devil (Score:5, Informative)
Seriously. They consume CPU. They stay resident and consume usable memory. They occasionally crash and/or cause other applications not to work. And, in this situation, they break Windows. I don't use AV and have had pretty much zero issues over the last 6 years of using Windows XP. All you need to do is:
* Configure Windows update to run daily.
* Don't use IE or Outlook.
* Keep Windows Firewall active.
* Don't connect directly to the internet- sit behind a router that's configured to be (mostly) invisible.
* Don't run random things you get sent in email, on facebook, or that pop up unexpectedly while you're at a questionable website.
* If you think something's amiss, boot into safe mode and use a non-resident tool like MBAM.
Re:For non-Windows-expert family tech-support type (Score:5, Informative)
Basically it looks like command line
shutdown -a (to stop the autorestart)
Put SVChost.exe back in place (out of the quarantine )
and disable McAfee...
My Experience (Score:5, Informative)
Re:Guess what I've been doing all morning? (Score:5, Informative)
Re:Black Wednesday (Score:1, Informative)
True, but business needs dictate software requirements. So that decision is out of my hands (but believe me, I'd LOVE to run an office full of Linux computers)...
Interesting.
We're forced to use Windows on Dell laptops, though I can see no business needs for it, nor any technical requirements (SaaS suites are used, and our various applications are almost all running on some Unix derivative). Our Exec team are all using OSX, showing that non-techies are quite able to do their business without Windows. Even then, there is no way in hell we'll get away from Windows, and almost as little chance we'd get away from Dell even if everyone in Internal IT hates Dell.
Re:McAfee recently screwed me over (Score:5, Informative)
Some sites use ad networks, which have happily served malware.
Other sites are run by clueless admins and left vulnerable to commodity exploits.
Drive by Downloads exist, and a risk everywhere.
Re:virus scanners are the devil (Score:5, Informative)
I used to believe something along those lines. Then my PC was infected with a worm when I plugged an mp3 player into the USB port. I'd bought the player new, factory-sealed, so it must have picked it up at the manufacturing plant. I disabled all autorun/autoplay after that, but I'm still wary enough that I run Avast to help avoid another similar situation.
Also, none of the things you mention will detect/remove a rootkit if one does manage to make its way onto your PC. I cleaned one up off of a PC that belongs to my sister a few weeks ago, and that was a headache. I did a scan of the infected drive in an external USB case, and that got nearly all of the infected files taken care of, but because most virus scanners apparently don't scan the MBR of non-boot drives, the rootkit was still waiting there and I had to use the Windows recovery console to write a new MBR.
As far as I can tell, her PC was infected through some variation of the "malicious PDF in a hidden IFRAME which belongs to an online advertisement" scenario, because she was already using Firefox exclusively. So maybe you should at least add "don't install Adobe Reader, or if you do, disable browser integration, update it daily, and set Firefox to download PDFs instead of opening them" and "install and use AdBlock Plus, and possibly NoScript" to your list.
More downside to malware than just downtime. (Score:5, Informative)
I agree that it raises question as to why one should use them, but "down time" is not the biggest threat out there, if you wanna talk loss/cost. While one's time is valuable, I'm thinking that their bank account information, passwords, etc, might be slightly more valuable to them. Personally, I think good secure end-user practices is the best protection, I do think that a good A/V program is needed.
So, while there is malware out there that is less harmful, more of the malware out there is much MORE harmful... if you disagree, please provide your financial account information, or contact me to transfer all funds to a secured off-shore account... maybe buy me a new car too! ;-)
But seriously... this is really bad, and REALLY stupid. But having no protection for most users risks damaging them in ways worse than a few hours of time to manually fix their issue. And from a corporate perspective, loss of sensitive information is a BIG deal and can cost a LOT more. And that's just talking about data loss. Being part of a botnet to help facilitate financial fraud and other badness... that's also double plus ungood... and irresponsible to not take measures to help keep your computer from playing a part in those crimes.
Anyway... I agree it raises question... but there more downside to malware than just downtime.
Re:Double ouch. (Score:5, Informative)
Norton, McAfee and Trend Micro have very solid products that allow for remote management, deployment, updates, forced scans, etc.
Avast (which I use at home) does not have all of these features yet. I can tell you that when dealing with hundreds of machines, having that dashboard for antivirus saves many hours of time. You can run more frequent scans on problem machines, or allow more/less freedom with the click of a button. Many of the products also have URL blocking (by category), email attachment filtering through Exchange plugins, etc. One feature I like about Trend Micro is the "behaviour" plugin, which flags anything out of the ordinary - such as accessing files, programs, or drives that they haven't before.
Corporate networks also typically have edge firewalls that will catch many of the malware infested URLs, email attachments, etc that cause problems. For many businesses 200+ computers, the Windows-installed Anti-virus software is actually the last line of defense. Often times the loss of productivity of a couple viruses getting through isn't worth the extra $$ invested in more products or a "better" product with less management features.
Licencing is also a plus. While Norton, McAfeee and Trend Micro are expensive initially, additional licences for a large number of computers and renewal licences each year actually make it less expensive than others such as Avast and Panda.
Re:Wonder what microsoft paid for this? (Score:5, Informative)
Marketing (Score:3, Informative)
Subject line says it all...
Re:For a program so hard to turn off (Score:3, Informative)
Re:virus scanners are the devil (Score:2, Informative)
Additionally,
* Don't click on links without verifying the actual link matches the name displayed in HTML when you mouse over it. When in doubt, type the root URL in by hand and browse to the specific page.
* Don't read spam. Anything anyone sends you, even family members, providing you with news, alerts, health related info, virus warnings, saftey warnings, etc, is ALL bullshit. HaoxBusters and snopes.com are your friends, when in doubt, LOOK UP the email there, and then tell your friend/family member to check themselves next time or risk being blacklisted. (I actually created a default reply script so when a family member sent me something that looked fishy, i ran a script that made a fairly convincing looking e-mail that would appear to come from a security server indicating the content of thier e-mail was blocked as it was known SPAM and may contain a virus, took a few months and they ALL stopped sending me crap...)
* Don't download and install anything unless its direct from a nationally known vendor and its a product sold commercially (or a known safe FOSS vendor). If it's not sold on a shelf in a store, ask yourself why not? Clearly, if it was a legit product, it should be... (yes, I know, many perfectly acceptable FOSS packages out there. in that case a good rule of thumb is that If 3 PC literate people you know can't name it, its not safe).
* ignore all adverts, block them if you can
* Don't use any account with admin privileged unless you're doing something at that moment that requires it.
* Use strong passwords, and use a DIFFERENT ONE on EVERY site. There are lots of tricks for coming up with good passwords, and for remembering which one is for which site.
* only sign up for what you have to; don't enter contests, marketing programs, or provide email addresses or phone numbers of your primary accounts. Some web sites insist on sending you an e-mail to validate an account ID: use a special, separate email account just for that, and immediately change any password they may issue you in that e-mail.
* never give out your personal/primary email address to a company or someone you do not personally trust for any reason.
* stay off P2P and other sharing systems completely.
* there's not just AntiVirus software, there's also AntiSpyware software, USE BOTH!
* Back up regularly, to a drive that is NOT always connected to your system (leaving a backup USB drive or network share mounted all the time means a virus can wipe out your backups too!) back up stuff you want to save from fire and other disasters online to a secure hosted system.
* When browsing questionable sites, do so from a virtual machine or a machine that uses completely different account information from your primary accounts and contains none of your personal files. A cheap old laptop is a good solution for that).
McAfee botching damage control (Score:5, Informative)
The story just hit ABC News, via the Associated Press: "McAfee Antivirus Program Goes Berserk, Reboots PCs" [go.com] There are stories on the Huffington Post and NextGov. The story just broke into mainstream news in the last hour. It just hit the New York Times.
There's nothing on McAfee's home page about this yet. No items in their "News" or "Threat Center" or "Breaking Advisory" sections. There's supposedly a McAfee Knowledge Base article, "False positive detection of w32/wecorl.a in 5958 DAT" [mcafee.com], but their knowledge base site is overloaded. When it eventually loads, there's a download link to a patch. But there's nothing like an apology. All they say is "Problem: Blue screen or DCOM error, followed by shutdown messages after updating to the 5958 DAT on April 21, 2010."
McAfee has botched their damage control. They should be out there apologizing. Meanwhile, you can watch McAfee stock drop. [yahoo.com]
Anonymous Coward (Score:1, Informative)
Yup - My contacts at Intel say they are down accross the board - more accuartely across the world (thats over 110,000 workstations folks). Employees are being advised to use their laptops and to make sure that they are not plugged into the network.
Thank god.... (Score:2, Informative)
Our fix method (Score:1, Informative)
Our fix method is as follows:
Download the extra.dat file from http://download.nai.com/products/mcafee-avert/wecorl/extra.dat and put it on your favorite removable media.
Reboot into safe mode.
Control-Shift-Esc to access Task Manager.
File, Run, cmd to access Command Prompt.
Copy extra.dat to C:\Program Files\Common Files\McAfee\Engine
Copy C:\windows\system32\dllcache\svchost.exe C:\windows\system32 (and overwrite).
Reboot into regular mode.
I have to wonder... (Score:3, Informative)
I have to wonder what controls the various AV companies have to prevent a malicious signature be inserted - for example, someone deliberately doing something like this (but hitting all versions of Windows).
It's not just McAfee that's had this particular style of false-positive problem - Symantec also falsely identified a legitimate part of the Windows 2003 Server resource kit as malware. Fortunately in Symantec's case the damage was very limited.
Re:McAfee botching damage control (Score:4, Informative)
I work in the financial industry, and this issue caused significant disruption to trading floors throughout Wall Street. Traders are generally quite upset with McAfee right now, so it makes sense that their stock is dropping :)
Re:Sigh... (Score:3, Informative)
Re:virus scanners are the devil (Score:4, Informative)
"I disabled all autorun/autoplay after that, but I'm still wary enough that I run Avast to help avoid another similar situation."
Yes to disabling autorun. That's the vector for the only worm I've seen in 10 years of running XP in the way the previous post described (it came in on a USB flash drive). So, add to his list:
* Disable autorun/autoplay correctly [us-cert.gov] (note: Microsoft's advice will NOT kill it off completely).
* Run something lightweight like StartupMonitor [mlin.net] to catch programs that try to install things in the various startup locations (useful to control bloatware too)
And something else I've done:
* make a fake, read-only AUTORUN.INF directory on usb flash drives and other portable devices so that when a worm tries to write on there, the filename already exists and it fails. So far I've not seen any worms smart enough to look for pre-existing files and delete them before attempting overwriting, and by making it a directory with that name the deletion process is more complicated.
Re:shutdown -a (Score:3, Informative)
Plug-ins (Score:4, Informative)
ClamWin *itself* doesn't have an on-access scanner but...
On the other hand, there are numerous plugins to hook clamwin to, so you can check for virus at their point of arrival.
(On the client's side there are Firefox [mozilla.org] and Outlook plugins, on the server's side there are Samba plugins)
but personally I supplement always ClamWin with a 2nd antivirus featuring a on-demand scanner.
ClamWin&Plugins +Avira or +AVG.
McAfee responds - by shutting down forum (Score:5, Informative)
Computerworld reports [computerworld.com] that McAfee has reacted to user complaints by shutting down their support forum. [mcafee.com] The forum seems to be back up now. That was an extremely dumb move to pull after the story was already in the New York Times, Business Week, and on TV.
Many frantic users in the forum. The big losers are the enterprise users who bought into McAfee's premium services, with automatic corporate-wide updating. There's no fully automatic, reliable fix yet for systems already damaged. In some cases, it's apparently necessary to bring in a new copy of "svchost.exe"; the one in quarantine is bad.
This points up a major risk to US computer infrastructure. Any program with remote update is potentially capable of taking down vast numbers of systems. Ones like McAfee or Windows Update, which deploy updates to all targets simultaneously, can cause widespread damage quickly. Remote updating by vendors may need to be regulated, as a public policy issue.