8 ms·
McAfee quarantines svchost.exe on millions of WinXP machines worldwide
- andreyf 17y agoErr, might be a good idea for an admin to change the URL to a more credible source, like http://isc.sans.org/diary.html?storyid=8656 http://isc.sans.org/diary.html?storyid=8656 Or at least: http://www.engadget.com/2010/04/21/mcafee-update--shutting-down-xp-machines/ http://www.engadget.com/2010/04/21/mcafee-update--shutting-d...
- dsplittgerber 17y agoIf I were a trader, I'd short McAfee right now. This probably means lots of settlements. EDIT: This could actually be a profitable venture. Somewith with at least basic HN-type knowledge and a daytrading account could make serious money. Finance professionals most probably have no idea how important specific IT news are during the day. One should be able to trade ahead of consensus pretty easily.
- jxcole 17y agoI will be watching throughout the day to see what happens: http://www.google.com/finance?q=NYSE:MFE http://www.google.com/finance?q=NYSE:MFE
- cynicalkane 17y agoYou'd be making a trade based on how the market responds to news. Just because you care about this news doesn't mean the market will. Unless the settlements are enormous, the market never will.
- dsplittgerber 17y agoYou have a point. Their market cap still dropped by 50 million in the last 40 minutes - whilst not being enormous, it's still noteworthy so far.
- awa 17y agoThe stock is just following S&P 500 and not dropping on its own http://www.google.com/finance?chdnp=1&chdd=1&chds=1&chdv=1&chvs=maximized&chdeh=1&chfdeh=0&chdet=1271880000000&chddm=782&chddi=300&chls=CandleStick&cmpto=INDEXSP:.INX&cmptdms=0&q=NYSE:MFE&ntsp=0 http://www.google.com/finance?chdnp=1&chdd=1&chds=1&...
- dsplittgerber 17y agoS&P 500 down 1.05% today, half an hour after opening bell, MFE down 3.6%. So it would have been a nice short after all.
- andreyf 17y agoUnless the settlements are enormous, the market never will. Or if they lose big clients. My wife tells me all computers in PWC's NYC office are out.
- spamizbad 17y agoShame on PWC for not upgrading to Vista or Windows 7. A firm that large should have more foresight in IT planning.
- pbhjpbhj 17y agoI looked at this sort of thing before for tech sector - MSFT when the European anti-trust stuff came off, etc. - but it never seems to make a difference for some reason.
- bshep 17y agoReally tempted to do this...
- mattmiller 17y agoI thought about doing this a while ago, and started watching to see if I could find any way to predict stock prices based on tech news. I saw nothing I would put money behind. The stock price wont change based on news until after that quarters earnings are released, and for a big company one technical glitch won't effect those.
- gorm 17y agoThis could be the most costly consumer software blunder ever? Imagine all the consultants called in for duty.
- mynameishere 17y agoFinance professionals most probably have no idea how important specific [fill-in-the-blank] news Yes, they do. There are lots of hedge funds that do nothing but analyze news feeds and trade on them all day long.
- dandelany 17y ago...unless their computers are down. :) Seriously though, although there are plenty of algorithms that crawl news all day and trade accordingly, I still think there is money to be made by watching the news with a financial eye. After reading Google's "A New Approach to China" post (which I saw on HN minutes after it was posted), I specifically remember thinking it would be a good time to go long BIDU. And of course, kicked myself after the stock gained ~15% over the next three days. The market responds fast, but consensus is not always reached immediately. I think the opportunity exists because events like this are like tiny "black swan" events, the lasting effects of which are not immediately perceptible to most people, let alone a computer algorithm. It's easy to write a script to trade on something like "expected earnings were 3c/share, actual earnings 5c/share" but this is complex information. The ability to put the pieces together and realize what a significant outage this is, why it is significant, why there is not an easy fix, and what most companies will do about it (prolly sue 'em or switch to Symantec) is more than a computer can do. And I'm sure hedge funds are doing the math right now, trying to estimate the possible damages from lawsuits and how it changes the company's value. But remember, you don't have to beat the fastest hedge funds, you just have to beat most of the market, and you'll still make money. Anyway, it will be interesting to see what happens at market open tomorrow :)
- paraschopra 17y agoBy definition itself, you can't predict black swan. As they say, day trading is not about making successful moves. It is about making successful moves even when you account for commissions. Reasons everyone is not doing automated trading is because commissions eat up any profit that you can expect to make.
- 17y ago
- mrcharles 17y agoJust another nail in the coffin of the usefulness of AV systems. And good riddance. My work computer actually has McAfee on it, which I've disabled through the registry. Don't like how slow it makes my computer. Education, people! It's better than buying useless feel-good software.
- watmough 17y agoI did some benchmarks on a Dell Precision M65. The hit from MacAfee was approximately 15-20% by my reckoning, in terms of time taken to run a compile and link cycle. Worse still, as you pointed out, responsiveness is affected, which can be incredibly frustrating.
- daten 17y agoWith fake SSL certificates signed by "real" CAs, cross-site scripting and other advances in phishing attacks, just educating users may not be as effective as it used to be. Malware is quickly becoming advanced enough that even trained technical users may be fooled. Many attacks don't require user interaction. AV products may be slow to respond and signature matching won't catch everything, but if it catches half of what shows up on corporate networks it can still save a lot of time and money.
- mrcharles 17y agoI wonder if the value of the total things stopped by McAfee, in all its time, outweighs the purported damage of this incident. I'm thinking no.
- orborde 17y agoOn what basis do you say no? This is a single large, noticeable incident, but that doesn't mean that it outweighs millions of tiny ones prevented.
- billybob 17y agoI think it's interesting to consider computer viruses and biological pathogens in terms of "optimum harmfulness." A cold virus's best strategy, for example, is to keep you awake coughing so your immune system is weak, make you sneeze and cough and have a runny nose so you spread germs, etc. But it shouldn't kill you, especially not before you pass it on. I've heard (did I read it in Guns, Germs and Steel?) that syphillis used to be more deadly, but that it got milder as an adaptive strategy. Likewise, computer viruses probably have a pain threshold they shouldn't pass. If they can do their masters' bidding without hacking you off so bad that you format the computer, they'll be more successful. Possibly unwarranted conclusion: computer viruses are now widespread precisely because they're Not That Bad. So, are they worse than antivirus software? A lot of non-geeks may be asking themselves that question today. "Dang, we got a virus one time, but it didn't keep the computer from BOOTing!" McAfee has just demonstrated a computer autoimmune disease.
- dfranke 17y agoSo they've finally identified Windows as a virus? About damned time.
- deleted 17y ago[deleted]
- RevRal 17y ago>Why do IT depts recommend installing this program? My suspicion is that they need something to spend a lot of money on. That old "more expensive perfume = better" thing, to appease the managers. I could be wrong.
- maukdaddy 17y agoYou are. Despite all of its shortcomings, AV is still pretty effective at blocking crap for non-technical users. Perfect? Of course not. But even a 50% catch rate is better than nothing. At my current job, we see our fair share of 0-day and too-new-to-be-caught-by-AV stuff. However, we also see a great deal of infections from viruses that are at least 1-2 years old. Even stupid AV can catch viruses that old.
- RevRal 17y agoI mean McAfee in lieu of a less expensive perfume, like Avast. I'm assuming Avast is less expensive.... Avast is better, though. (And is it just me or is HN freaking out right now?)
- maukdaddy 17y agoThe only problem with Avast is enterprise management. Products like Symantec and McAfee suck, but at least provide options for managing 100k+ deployments.
- sokoloff 17y agoHave a look at Sophos (http://www.sophos.com/ http://www.sophos.com/). It was the only one I found in my testing to not destroy Windows filesystem performance when real-time scanning was enabled and to have no discernable impact when real-time scanning was disabled. (Symantec, McAfee, AVG and Avast all hurt disk performance quite a bit, EVEN when disabled, merely by being installed. F-secure was the only other I found to not harm disk performance when installed but inactive.) Sophos also has a decent enterprise management console. No connection, other than as a customer.
- jswinghammer 17y agoI don't understand why people install antivirus software on their machines. I read once that their catch rate is something like 20-30% which strikes me as no better than 0% for all the good it does most of their customers. It just seems to slow down computers a lot and yield little benefit other than protection for the IT staff when things go wrong. I could make antivirus software that does nothing and probably make people happier by virtue of the fact that I'm not taking their system's resources.
- goodmitton 17y agoI don't understand how even having a 20% detection rate isn't better than 0%. Am I missing something? Are there a lot of viruses popping over the net that even the 20% detection is already too late?
- jswinghammer 17y agoGiven the cost in equipment purchases, user annoyance, lost productivity and purchasing the software itself it strikes me that you need much higher success rates to be worth all that.
- dirtbox 17y agoThe 20% figure that was "once read" about is pure fiction. Any up to date test figures reveal something closer to 99.8% of a 3 million sample testbase for the better AVs. It's all a bit moot though as before this happened, McAfee was probably worse than anything a PC can get infected with. Now it's gone and proved it beyond any doubt.
- mattmanser 17y agoBut that's totally meaningless! Think of it in another way, at any point in time you have x number of virus that you are likely to come across through whatever means. If all those viruses are in the 0.2%, then the catch rate isn't going to be 99.8% it's going to be 0%. So being able to catch 99.8% of 3 millions viruses when new ones are released all the time is a pointless comparison for efficiency.
- deleted 17y ago[deleted]
- azim 17y agoThe fact that you're here means your computer is working, but just in case anyone you know needs the instructions to disable McAfee: Boot the affected client into Windows Safe Mode with Networking (Hit F8 During the system boot phase.) Disable the McAfee McShield service by opening the Registry Editor (regedit.exe), and set the McAfee McShield service to the Disabled startup type: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\McShield\Start=4. Once you've rebooted in to normal mode you can rollback definitions from the McAfee gui.
- postfuturist 17y agohttp://xkcd.com/694/ http://xkcd.com/694/
- jules 17y agoI had this same problem with AVG on my parents' PC some time ago: it deleted an essential system file, making the computer unable to boot even in safe mode. I then did what they said that I should do, thereby fucking Windows up completely. Luckily I was able to recover important files via Ubuntu.
- tumblen 17y agoCrazy to think about the consequences of a mistake like this. This was sent by a friend to an email list I'm on: "Well, consider this community hospital fubared. IT dudes running around pulling out their hair. If it wasn't affecting patient care it would be a humorous scene-but I can't check xray's, or labs or anything. Took out a horrendously bloody gallbladder this morning, and I can't tell (labwise) if she's still bleeding...not good."
- billybob 17y agoWow. Kinda makes me wonder if we should be using general-purpose computers for so many things. The anti-virus is kind of a major single point of failure for machines that need to do just a few specific things.
- chbarts 17y agoBest Practices, n.: Making the same mistakes everyone else does. However, what are the odds of someone being able to make special-purpose machines to do everything COTS boxes are used for, and making those machines as fast, cheap, and reliable as COTS systems are now? Some things seem obvious (x-ray machines, lab machines) but accounting and record-keeping? Going back to adding machines and purely manual filing is not an option in a large hospital, especially if it has to maintain modern standards of patient care over a large patient population.
- smhinsey 17y agoI think virtualization takes you a long way towards the solution to this issue. With Win7 I've gotten into the habit of routinely working on virtual instances using the boot from .vhd feature. This means that if something goes wrong my host is not impacted and I can revert to an earlier version of my .vhd to solve problems like this one. The standard IT "wait and see" policy makes this something that will take awhile to become common but I think it is the way to go for pretty much any critical path task you do on a Windows PC (other OSes such as OS X have similar features as well but I only use OS X for "media" stuff).
- thaumaturgy 17y agoI don't have time to counter all the misinformation here. Just a couple quick points: - McAfee has been crap for a long time now; they're not much better than Norton's products from the last few years. - Corporate networks are running McAfee because McAfee (and TrendMicro, and other garbage a/v vendors) provide incentives to VARs, consultants, resellers, etc. - However, this is a far cry from "all antivirus is bad". There are plenty of good products available, some of them are free, and they don't have serious negative impacts on system performance. The on-demand catch rating of some of these products exceeds 97% in independent lab testing, which is pretty damn good. - If you use a company computer, and you have disabled antivirus on your system because you don't like it, you are putting not just your company's computer, but your company's network at risk. In most "serious" companies, this would be grounds for termination, and I don't blame them. I would also like to emphasize that the workstation you use belongs to your employer, not you. - I don't care how smart you think you are, if you're running Windows, you're at risk. Even current versions of Firefox are vulnerable to remote exploits, and we've been seeing a hell of an uptick recently in website infections. That blog that you've been visiting for years might try to hit your computer with something nasty tomorrow, and you'll never even notice. For that matter, a lot of website administrators don't realize they have a problem for a long time. - Rootkits are getting very quiet and very sneaky. I think we're starting to see a trend where computers are coming in with a couple of different infections: one is a recent rogue antivirus infection which drives the user to get help, and the other is an older rootkit that's been running quietly in the background for a while. You guys should know better.
- doki_pen 17y agoFirst off, I don't claim to be an IT person or know what normal users need to be safe. I can only speak to my personal experience as a programmer. I haven't had a virus in 14 years. I haven't ever run anti-virus software. I have a good feel for all the systems that I use. A little paranoia goes a long way. Not to say that I couldn't be targeted. I'm sure a skilled cracker could break my boxen. But I doubt any antivirus would stop them.
- proee 17y ago
- Daniel_Newby 17y agoWhy does AV software not have a secure checksum-based whitelist? It is not as if Microsoft keeps the important system files secret.
- jxcole 17y agoFor that matter, why didn't they test this on at least one machine before releasing it? Is it not standard to have a release process that includes testing?
- adamsmith 17y agoNot to mention incremental roll outs, which would have caught this problem before it hit every win xp machine.
- zmmmmm 17y agoA guess: presumably whatever checksum they invent will have a severe risk that hackers will reverse engineer it and then devote their vast botnets to manufacturing virii that give the same checksum thus handing them even more control.
- Daniel_Newby 17y agoThere are secure hash algorithms and message authentication codes that are extremely secure.
- Jd 17y agoAnyone think that this might be an ingenious hack by a "virus" writer? Instead of targeting the computer, target the manufacturer that makes the code that is supposedly protecting the computer. If so, I'll bet all it took was one line in one list of malicious files. No one may have thought to protect those back doors...
- Qz 17y agoThe anti-virus scam strikes again!
- Hexstream 17y ago"- Don't worry, Skynet will take care of the virus in no time. - Skynet IS the virus!!!"
- deleted 17y ago[deleted]
- alecco 17y agoSome virus guy wrote about the problem of the economic model of major antivirus vendors. Corporate profit interest go against making a decent long lasting antivirus and instead benefit from incremental constant updates. That's why they mostly avoid behavioral analysis and localhost security checks. Instead they just use brute force pattern matching and constant updates. A subscription model is detrimental to users' security. But try to explain that to your PHB who reads websites and magazines making money on advertisements from the industry.