McAfee Kills SVCHost.exe, Sets Off Reboot Loops For Win XP, Win 2000 472
Kohenkatz writes "A McAfee Update today (DAT 5958) incorrectly identifies svchost.exe, a critical Windows executable, as a virus and tries to remove it, causing endless reboot loops."
Reader jswackh adds this terse description: "So far the fixes are sneakernet only. An IT person will have to touch all affected PCs. Reports say that it quarantines SVCHOST. [Affected computers] have no network access, and missing are taskbar/icons/etc. Basically non-functioning. Windows 7 seems to be unaffected."
Updated 20100421 20:08 GMT by timothy: An anonymous reader points out this easy-to-follow fix for the McAfee flub.
Why Worry about Malware-Viruses... (Score:5, Funny)
Sometimes the cure is worse than the disease (Score:2)
After all if a hacker/malware causes downtime less often than the vendor's screw-ups, why use the vendor's product? Safer to look for a vendor with a better track record even if they have more false negatives (especially with rare and/or ancient stuff).
There are overheads and performance impacts to using such stuff, in addition to just the price t
More downside to malware than just downtime. (Score:5, Informative)
I agree that it raises question as to why one should use them, but "down time" is not the biggest threat out there, if you wanna talk loss/cost. While one's time is valuable, I'm thinking that their bank account information, passwords, etc, might be slightly more valuable to them. Personally, I think good secure end-user practices is the best protection, I do think that a good A/V program is needed.
So, while there is malware out there that is less harmful, more of the malware out there is much MORE harmful... if you disagree, please provide your financial account information, or contact me to transfer all funds to a secured off-shore account... maybe buy me a new car too! ;-)
But seriously... this is really bad, and REALLY stupid. But having no protection for most users risks damaging them in ways worse than a few hours of time to manually fix their issue. And from a corporate perspective, loss of sensitive information is a BIG deal and can cost a LOT more. And that's just talking about data loss. Being part of a botnet to help facilitate financial fraud and other badness... that's also double plus ungood... and irresponsible to not take measures to help keep your computer from playing a part in those crimes.
Anyway... I agree it raises question... but there more downside to malware than just downtime.
Re: (Score:2)
Don't forget that AV software costs you ALL the time when it's installed in "real time" scanning mode.
Re:Why Worry about Malware-Viruses... (Score:5, Funny)
My boss, who knows just enough about computers to get himself in trouble, is an idiot.
A few days ago, he called me in to come look at his laptop. He said that his computer was infected and that the virus killed his email. After further inspection, I found out that he pressed "ctrl+alt+del" and brought up the Task Manager. He went through and ended all of the svchost.exe's that he could. When I asked him about it, here was his response:
"I was closing all of those system virus hosts on my machine!"
I hate my job sometimes.
Re: (Score:2)
For a program so hard to turn off (Score:4, Insightful)
Re:For a program so hard to turn off (Score:4, Interesting)
It seems to be very willing to take the whole machine down.
Speaking of which, did anyone at McAfee even bother to test this dat on a Windows XP machine?
I'm sure they did but the real question is not "did McAfee test it against Windows XP?". It's "did they test it against Windows XP with every single version of svchost.exe that Microsoft have ever released?" - the original version and every updated version in every patch and service pack to date?
Re:For a program so hard to turn off (Score:5, Insightful)
A decent antivirus would have every critical Windows whitelisted just to avoid this sort of problem.
This isn't some user-installed application, it's svchost.exe.
Re: (Score:3, Insightful)
The problem with doing that is all a virus needs to do now is to infect a critical Windows file and you'd never know about it.
Re:For a program so hard to turn off (Score:5, Insightful)
Whitelist them by checksum, not filename.
Re:For a program so hard to turn off (Score:4, Insightful)
Actually, you can't trust anything once a machine's compromised, which to my mind is a huge problem with modern Windows systems, but I'm not even going to go there....
It’s a huge problem with any system.
Re:For a program so hard to turn off (Score:5, Insightful)
Actually, you can't trust anything once a machine's compromised, which to my mind is a huge problem with modern Windows systems, but I'm not even going to go there....
Guess where the "root" in "rootkit" comes from?
Hint: it ain't Windows.
Re:For a program so hard to turn off (Score:4, Insightful)
And that antivirus program would be susceptible to many types of viruses that modify system files. This particular virus that it detects (W32.Wecorl.a) does change svchost.exe:
http://www.symantec.com/security_response/writeup.jsp?docid=2008-110306-2212-99 [symantec.com]
What McAfee should have is a better way of quarantining critical system files (replace with known good copies, have a robust patch/repair process for system files, have a more stringent fingerprint detection, etc). Maybe a whitelist of known good md5sums for system files (of course, this would have to be updated with every version of those files ever released in any patch by Microsoft).
Re:For a program so hard to turn off (Score:4, Interesting)
I put this on my corporate IT.
We have a corporate standard for XP on the desktop and Win 2003 for servers. Should only be those 2 versions of svchost.exe to test against.
Right now my employer is losing $millions as systems are down proactively until the issue is resolved. Manufacturing and labeling systems run on Windows :)
I know we test patches from Microsoft against the standard OS as well as the individual apps. As an application owner, I test the monthly patches from MS before applying in production.
Virus definition updates are not provided for testing prior to release.
Given how widespread this issue is, I think it would have been picked up in testing.
Re: (Score:3, Insightful)
Two versions! You think there have only been two versions of svchost.exe on XP and 2003?
Not in all the universe. But I don't care about the universe, I just care about my company.
And in my company, with very few exceptions, all Windows systems get the same patches (that is, all workstations get the same workstation patches, all servers get the same server patches). So yes, at any one time, my Windows group can focus their attention on testing with those two versions of Windows--one XP and one Server.
Anywa
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
Svchost has been around forever. It basically encapsulates other applications. Svchost handles many things from DCHP client to Windows Themes. The problem is that McAfee doesn't seem to ...
Encapsulation? No doubt that's a valid comment and one that's just as valid to describe, in a more general sense, how Microsoft designs things. On the other hand, I consider a weasel word that describes something that lacks transparency, isn't understandable, and is unnecessarily complex.
If you think that's an over-the-
Guess what I've been doing all morning? (Score:5, Funny)
Re:Guess what I've been doing all morning? (Score:5, Funny)
Seriously, though, we got hit hard with this. I don't mind fixing the problem, what pisses me off is that we didn't want McAfee in here in the first place but Corporate HQ forced it on us.
Re:Guess what I've been doing all morning? (Score:4, Insightful)
Seriously, though, we got hit hard with this.
I'm trying to avoid having this happen. I just called our guy who manages the AV server (among other things) and sent him this. He was skeptical, but wasn't opposed to rolling back the server to using 5957 for now until more builds on this story. My system hasn't updated to 5958 yet, even though the AV server was set to deploy that. Let's hope for the best...
Re:Guess what I've been doing all morning? (Score:5, Informative)
Re: (Score:2)
I'm sure they'll find some way to blame your department too.
Re:Guess what I've been doing all morning? (Score:5, Funny)
Re: (Score:2)
Updating your resume?
Re:Guess what I've been doing all morning? (Score:5, Insightful)
Funny that one of the 'false reasons' against Open Source is liability
So are you going to sue the bastards for lost time and productivity?? You should.
Re: (Score:3, Interesting)
I always get a kick when somebody says something stupid like that. I've recently heard that in a meeting with management: "Yeah, but if Microsoft's solution doesn't work, we can call them for help and they are liable for the problems with their product". As ANYONE that ever called Microsoft knows, they're not helpful at all and if you spent too much time on their support lines they will come off with something like: well, we don't support customizations, we can't fix that, read the support contract. Under c
Re: (Score:2)
Crap! I wish more of my clients used McAfee!
Re:Guess what I've been doing all morning? (Score:4, Interesting)
Me too. I just handle my department, thank the gods. I've got two labs that are native Windows -- one with 7 machines and one 15 machine lab. These are hardware oriented labs that have vendor provided software that won't run under emulation.
The other 4 labs run Ubuntu, with VMWare, non-persistent VMs for any activities that absolutely require Windows.
My Windows only labs are in a constant reboot cycle (well, before I shut them down), the rest don't even realize there's anything going on. :) Since tomorrow is Lab day for those two labs, I'm hoping McAfee gets the problem fixed before then. If not, I'll disable boot scan until they do.
antivirus... poison for cure (Score:2)
This way running anti-virus is worse for an end user than no anti-virus.
The cure becomes worse than the disease.
At least being part of a spam-spewing botnet keeps the computer mostly functional.
Re:antivirus... poison for cure (Score:5, Insightful)
Well, with McAfee, the cure has been worse than the disease for over a decade now. But the cure is easier to explain to management.
Windows is a virus (Score:5, Funny)
We've known for a long time but it's good that McAffee finally admitted it.
Sigh... (Score:4, Funny)
I would have gotten first post, but I was running windows with McAfee
Re: (Score:3, Informative)
QA (Score:2)
What possible scenario allowed this CharlieFox past QA?
Re: (Score:2)
Easy peasy..
The scenario is, there was no (decent) QA.
Any idea when this was pushed out? (Score:2)
I don't see any indication of when this first went out.
(My wife runs McAfee and launched an update around 3 AM PDT before hitting the sack...)
shutdown -a (Score:5, Informative)
Re: (Score:3, Informative)
I heard (Score:5, Funny)
Next they will be deleting a directory known to be full of malware called system32
Doesn't McAfee Do Testing On Releases? (Score:3, Interesting)
-Todd
Re: (Score:2)
Well, if their support is anything to go by, the answer to that is a resounding yes.
Re: (Score:3, Insightful)
From some of the other comments on this story, from sysadmins fixing this, it sounds like it hits near completely- or completely-patched XP machines. That's extremely silly a thing to just 'whoops' on.
McAfee recently screwed me over (Score:3, Interesting)
Sure maybe I got unlucky for the first time in like 3 years. Maybe someone used my computer while I was on holiday but I suspect not. I suspect it's related to this.
Re:McAfee recently screwed me over (Score:5, Informative)
Some sites use ad networks, which have happily served malware.
Other sites are run by clueless admins and left vulnerable to commodity exploits.
Drive by Downloads exist, and a risk everywhere.
virus scanners are the devil (Score:5, Informative)
Seriously. They consume CPU. They stay resident and consume usable memory. They occasionally crash and/or cause other applications not to work. And, in this situation, they break Windows. I don't use AV and have had pretty much zero issues over the last 6 years of using Windows XP. All you need to do is:
* Configure Windows update to run daily.
* Don't use IE or Outlook.
* Keep Windows Firewall active.
* Don't connect directly to the internet- sit behind a router that's configured to be (mostly) invisible.
* Don't run random things you get sent in email, on facebook, or that pop up unexpectedly while you're at a questionable website.
* If you think something's amiss, boot into safe mode and use a non-resident tool like MBAM.
Re: (Score:3, Interesting)
To be honest 2, 4 and 5 are perfectly adequate for a knowledgeable user and the rest provide little if any advantage. And they also happen to apply to all OS's and all versions of those OS's.
Re: (Score:2, Funny)
You missed the obligatory:
* Run Linux
Re: (Score:3, Insightful)
That's not enough any more; even reputable websites can often be easily compromised either through SQL injection, XSS, compromised ad server or some other mechanism and apps like Adobe Reader, Office, Flash, Foxit Reader, Firefox, Java, VLC and more have all experienced serious vulnerabilities in recent months, which have often remained unpatched for long periods of time.
I finally gave in and installed my home-licensed copy of Sophos (provided by my work) because there are too many factors outside of my con
Re: (Score:2)
I have an easy solution: buy a mac.
Re: (Score:2)
I have a better solution:
Install Linux.
Re:virus scanners are the devil (Score:5, Informative)
I used to believe something along those lines. Then my PC was infected with a worm when I plugged an mp3 player into the USB port. I'd bought the player new, factory-sealed, so it must have picked it up at the manufacturing plant. I disabled all autorun/autoplay after that, but I'm still wary enough that I run Avast to help avoid another similar situation.
Also, none of the things you mention will detect/remove a rootkit if one does manage to make its way onto your PC. I cleaned one up off of a PC that belongs to my sister a few weeks ago, and that was a headache. I did a scan of the infected drive in an external USB case, and that got nearly all of the infected files taken care of, but because most virus scanners apparently don't scan the MBR of non-boot drives, the rootkit was still waiting there and I had to use the Windows recovery console to write a new MBR.
As far as I can tell, her PC was infected through some variation of the "malicious PDF in a hidden IFRAME which belongs to an online advertisement" scenario, because she was already using Firefox exclusively. So maybe you should at least add "don't install Adobe Reader, or if you do, disable browser integration, update it daily, and set Firefox to download PDFs instead of opening them" and "install and use AdBlock Plus, and possibly NoScript" to your list.
Re:virus scanners are the devil (Score:4, Informative)
"I disabled all autorun/autoplay after that, but I'm still wary enough that I run Avast to help avoid another similar situation."
Yes to disabling autorun. That's the vector for the only worm I've seen in 10 years of running XP in the way the previous post described (it came in on a USB flash drive). So, add to his list:
* Disable autorun/autoplay correctly [us-cert.gov] (note: Microsoft's advice will NOT kill it off completely).
* Run something lightweight like StartupMonitor [mlin.net] to catch programs that try to install things in the various startup locations (useful to control bloatware too)
And something else I've done:
* make a fake, read-only AUTORUN.INF directory on usb flash drives and other portable devices so that when a worm tries to write on there, the filename already exists and it fails. So far I've not seen any worms smart enough to look for pre-existing files and delete them before attempting overwriting, and by making it a directory with that name the deletion process is more complicated.
Re:virus scanners are the devil (Score:4, Insightful)
How about nothing is executable until you explicitly change the permissions, and nothing on removable media is executable. That way there is no accidental running of any programs.
Autorun should have been killed when Windows 95 was still around. It's such an obvious security risk.
Re: (Score:2)
You forgot a couple things:
1) Don't run as an admin account except for admin tasks.
2) Keep your Adobe products up to date - including Flash and Reader. Someone else you trust might have been compromised and send you an infected PDF file.
3) Allow Windows Update to install MRT and update it every time the monthly definitions update comes out.
Running Windows Update daily won't really help you so much but I agree with the reasons you have for keeping it that way. Microsoft releases most patches on the 2nd Tuesd
Re: (Score:3, Insightful)
DAT (Score:2)
C:\Program Files\Common Files\McAfee\Engine\avv*.dat
Nuff said
Remember when.... (Score:2)
Remember when Macafee was distributed on BBS's and it was actually pretty good...
yeah...
those days are long gone.
So they don't do any QA at all then? (Score:2)
XP SP3, it's not exactly uncommon...
Re: (Score:2)
As a QA guy, I can tell you from experience at past companies (not the present one, thankfully) that some dimwitted middle manager was in a hurry to make a deadline. You get to pay for that.
My Experience (Score:5, Informative)
Re:My Experience (Score:4, Insightful)
I think the people who have software that autodeploys updates to 20-50k employees without getting a say in the matter (i.e. testing, change management, etc.) have a lot more to answer for. When the software that supposed to *save* your productivity by preventing viruses ends up doing this to your sites, it's time to just throw it in the bin.
Too bad it wasn't ClamAV this time. (Score:2)
I bet that after seeing what McAfee can do when it screws up, they won't bitch about what ClamAV did [slashdot.org].
(for those who need the summary: ClamAV pulled an update that caused it to shut itself down if it was version 0.94 or older after announcing ~6 months in advance that people needed to update, and kept filling log files with warnings to update. McAfee is breaking a Windows component that causes the entire computer to not function, with a less obvious warning, left for the reader to figure out. The hint is the
Some versions of McAfee, not others (Score:2)
Based on what we're seeing and reports from the internet, McAfee 8.0 and 8.5 are unaffected by this problem, while versions 8.7 and 8.9 are. It's also XP specific. Still, that combination has to be a very large number of computers worldwide.
How does this happen? (Score:2, Insightful)
Running "shutdown -a" will stop the reboot (Score:2)
long enough for you to become utterly frustrated that there's no easily downloaded fix from McAfee.
I feel sorry for their phone support staff (Score:2)
Not only do they have to listen to people bitch (rightfully), but since they're likely running Windows XP + McAfee, they can't use their logging tools (meaning they have to do it by hand and then log later), can't get online updates when solutions are available etc.
SVCHOST (Score:2)
Back when I used to run a pirated copy of Windows XP I used to get a particular virus all the time. What it did was mimic SVCHOST and use your computer, presumably as a botnet zombie. In some instances you would get a whole bunch of SVCHOST running. However the trouble was, one of those is a legit Windows service. Kill the right one, and you computer speeds up, kill the wrong one, and your computer grinds to a halt.
It sure sounds like they were trying to target that virus (years too late) and killed the wro
dodged a bullet (Score:3, Funny)
Are you sure it's not a virus? (Score:4, Funny)
I've never liked SVCHOST.EXE anyhow. I'm glad it deletes it.
McAfee botching damage control (Score:5, Informative)
The story just hit ABC News, via the Associated Press: "McAfee Antivirus Program Goes Berserk, Reboots PCs" [go.com] There are stories on the Huffington Post and NextGov. The story just broke into mainstream news in the last hour. It just hit the New York Times.
There's nothing on McAfee's home page about this yet. No items in their "News" or "Threat Center" or "Breaking Advisory" sections. There's supposedly a McAfee Knowledge Base article, "False positive detection of w32/wecorl.a in 5958 DAT" [mcafee.com], but their knowledge base site is overloaded. When it eventually loads, there's a download link to a patch. But there's nothing like an apology. All they say is "Problem: Blue screen or DCOM error, followed by shutdown messages after updating to the 5958 DAT on April 21, 2010."
McAfee has botched their damage control. They should be out there apologizing. Meanwhile, you can watch McAfee stock drop. [yahoo.com]
Re:McAfee botching damage control (Score:4, Informative)
I work in the financial industry, and this issue caused significant disruption to trading floors throughout Wall Street. Traders are generally quite upset with McAfee right now, so it makes sense that their stock is dropping :)
Re:McAfee botching damage control (Score:5, Funny)
You think it's dropping now? Just wait until more of the traders get their computers working!
I have to wonder... (Score:3, Informative)
I have to wonder what controls the various AV companies have to prevent a malicious signature be inserted - for example, someone deliberately doing something like this (but hitting all versions of Windows).
It's not just McAfee that's had this particular style of false-positive problem - Symantec also falsely identified a legitimate part of the Windows 2003 Server resource kit as malware. Fortunately in Symantec's case the damage was very limited.
Alas, poor McAfee.. (Score:3, Insightful)
McAfee responds - by shutting down forum (Score:5, Informative)
Computerworld reports [computerworld.com] that McAfee has reacted to user complaints by shutting down their support forum. [mcafee.com] The forum seems to be back up now. That was an extremely dumb move to pull after the story was already in the New York Times, Business Week, and on TV.
Many frantic users in the forum. The big losers are the enterprise users who bought into McAfee's premium services, with automatic corporate-wide updating. There's no fully automatic, reliable fix yet for systems already damaged. In some cases, it's apparently necessary to bring in a new copy of "svchost.exe"; the one in quarantine is bad.
This points up a major risk to US computer infrastructure. Any program with remote update is potentially capable of taking down vast numbers of systems. Ones like McAfee or Windows Update, which deploy updates to all targets simultaneously, can cause widespread damage quickly. Remote updating by vendors may need to be regulated, as a public policy issue.
Re: (Score:2)
Re:Black Wednesday (Score:5, Interesting)
Re:Black Wednesday (Score:4, Insightful)
Or you can go back to pencil and paper. Much more cost effective than Linux.
Re: (Score:3, Insightful)
There is a lot of business software that runs only on windows so the whole "just switch to linux" thing is quite impossible in many cases. Of course the problem here isn't windows, it's McAfee, but don't let that stop you from pretending that linux is superior to windows in every way.
The needs of the business dictates what O/S is used. Sometimes linux is best, sometimes windows is. If I acted like a fanboy and let my personal bias overrun the needs of the company then I wouldn't have a job for very long, an
Re:Black Wednesday (Score:5, Insightful)
Your wise advice has galvanized me to action!
I am switching the entire company over to Linux this very instant.
Just as soon as I find the AutoCAD for Linux install CDs.
Re:Double ouch. (Score:5, Interesting)
My big question is why is Norton and McAfee still so popular in the corporate world?
I understand that the OEM's preload McAfee or Norton because they are paid to, but the corporate world is paying big money for these out-dated anti-virus programs.
There are much better anti-virus providers out there such as Avast, Kaspersky, Nod32 and others.
Re: (Score:2)
Most AV companies have a range of products which are frequently entirely unrelated to each other.
Symantec have Norton (terrible), Symantec Enterprise (actually not too bad, although it's being obsoleted in favour of Endpoint Protection) and Symantec Endpoint Protection (which requires a Windows server even though it's a Java application which installs Tomcat and Apache in order to operate).
McAfee have a home product, an enterprise product and a "serviced" product (fairly standard managed AV product only you
Re:Double ouch. (Score:5, Informative)
Norton, McAfee and Trend Micro have very solid products that allow for remote management, deployment, updates, forced scans, etc.
Avast (which I use at home) does not have all of these features yet. I can tell you that when dealing with hundreds of machines, having that dashboard for antivirus saves many hours of time. You can run more frequent scans on problem machines, or allow more/less freedom with the click of a button. Many of the products also have URL blocking (by category), email attachment filtering through Exchange plugins, etc. One feature I like about Trend Micro is the "behaviour" plugin, which flags anything out of the ordinary - such as accessing files, programs, or drives that they haven't before.
Corporate networks also typically have edge firewalls that will catch many of the malware infested URLs, email attachments, etc that cause problems. For many businesses 200+ computers, the Windows-installed Anti-virus software is actually the last line of defense. Often times the loss of productivity of a couple viruses getting through isn't worth the extra $$ invested in more products or a "better" product with less management features.
Licencing is also a plus. While Norton, McAfeee and Trend Micro are expensive initially, additional licences for a large number of computers and renewal licences each year actually make it less expensive than others such as Avast and Panda.
Re: (Score:3)
Marketing (Score:3, Informative)
Subject line says it all...
Re: (Score:2)
Reasons I've seen:
They advertise the best. Most people in management positions won't go with something they've never seen in an ad on T.V.
"If it's so good then why haven't I ever heard of it?"
They cost the most.
"Something that cheap couldn't possibly be any good."
Re: (Score:3, Interesting)
A quick google on the subject brings up many other testing that ranks norton below the ones I mentioned.
So it would all boil down to whom you believe, who is the least beholden to their advertisers?
And Norton and McAfe spend TONS on advertising.
Re: (Score:2)
But do they take into account the false positive track record?
That's a relevant point here. I believe Norton/Symantec have also had similar high-impact false positives.
If Antivirus software "A" detects fewer viruses than Norton but only misses out the rare and old ones (e.g. from the DOS era), has been around for years and had zero high impact false positives, I'd prefer it to Norton even if Norton has the lowest false n
Re: (Score:2)
"So uh, anyone know how to disable McAfee completely?"
Wipe Windows completely and reinstall from a fresh disc without all the crapware added.
Re:For non-Windows-expert family tech-support type (Score:5, Informative)
Basically it looks like command line
shutdown -a (to stop the autorestart)
Put SVChost.exe back in place (out of the quarantine )
and disable McAfee...
Re: (Score:2)
From a comment on TFA
"One fix is to delete the bad DAT file the client at "C:\Program Files\Common Files\McAfee\Engine". Delete any av*.dat. Then reboot and the old DAT should be grabbed."
Re: (Score:2)
Step 2: Reboot and uninstall McAfee.
Re: (Score:2)
And you have exactly 60 seconds to do that? :-)
Re: (Score:2)
Nice change management you have there.
Re:Wonder what microsoft paid for this? (Score:5, Informative)
Re: (Score:2)
I think your first mistake was looking at Mcafee. Your second is looking at Avira. The proper solution is to look at Clamwin, as it's free and will enable you to have more flexibility in making it do what you want.
Plug-ins (Score:4, Informative)
ClamWin *itself* doesn't have an on-access scanner but...
On the other hand, there are numerous plugins to hook clamwin to, so you can check for virus at their point of arrival.
(On the client's side there are Firefox [mozilla.org] and Outlook plugins, on the server's side there are Samba plugins)
but personally I supplement always ClamWin with a 2nd antivirus featuring a on-demand scanner.
ClamWin&Plugins +Avira or +AVG.
Re:Wonder what microsoft paid for this? (Score:4, Insightful)
Re: (Score:3, Insightful)