McAfee quarantines svchost.exe on millions of WinXP machines worldwide

http://andreyf.tumblr.com/post/538652366/hacker-attack

by andreyf • 16 years ago

249 99 16 years ago

andreyf.tumblr.com

andreyf2• 16 years ago

Err, might be a good idea for an admin to change the URL to a more credible source, like http://isc.sans.org/diary.html?storyid=8656

Or at least: http://www.engadget.com/2010/04/21/mcafee-update--shutting-d...

dsplittgerber4• 16 years ago

If I were a trader, I'd short McAfee right now. This probably means lots of settlements.

EDIT: This could actually be a profitable venture. Somewith with at least basic HN-type knowledge and a daytrading account could make serious money. Finance professionals most probably have no idea how important specific IT news are during the day. One should be able to trade ahead of consensus pretty easily.

jxcole2• 16 years ago

I will be watching throughout the day to see what happens:

http://www.google.com/finance?q=NYSE:MFE

cynicalkane• 16 years ago

You'd be making a trade based on how the market responds to news. Just because you care about this news doesn't mean the market will. Unless the settlements are enormous, the market never will.

dsplittgerber4• 16 years ago

You have a point. Their market cap still dropped by 50 million in the last 40 minutes - whilst not being enormous, it's still noteworthy so far.

andreyf2• 16 years ago

Unless the settlements are enormous, the market never will.

Or if they lose big clients. My wife tells me all computers in PWC's NYC office are out.

pbhjpbhj• 16 years ago

I looked at this sort of thing before for tech sector - MSFT when the European anti-trust stuff came off, etc. - but it never seems to make a difference for some reason.

bshep• 16 years ago

Really tempted to do this...

mattmiller• 16 years ago

I thought about doing this a while ago, and started watching to see if I could find any way to predict stock prices based on tech news. I saw nothing I would put money behind. The stock price wont change based on news until after that quarters earnings are released, and for a big company one technical glitch won't effect those.

gorm• 16 years ago

This could be the most costly consumer software blunder ever? Imagine all the consultants called in for duty.

mynameishere• 16 years ago

Finance professionals most probably have no idea how important specific [fill-in-the-blank] news

Yes, they do. There are lots of hedge funds that do nothing but analyze news feeds and trade on them all day long.

dandelany• 16 years ago

...unless their computers are down. :)

Seriously though, although there are plenty of algorithms that crawl news all day and trade accordingly, I still think there is money to be made by watching the news with a financial eye. After reading Google's "A New Approach to China" post (which I saw on HN minutes after it was posted), I specifically remember thinking it would be a good time to go long BIDU. And of course, kicked myself after the stock gained ~15% over the next three days. The market responds fast, but consensus is not always reached immediately.

I think the opportunity exists because events like this are like tiny "black swan" events, the lasting effects of which are not immediately perceptible to most people, let alone a computer algorithm. It's easy to write a script to trade on something like "expected earnings were 3c/share, actual earnings 5c/share" but this is complex information. The ability to put the pieces together and realize what a significant outage this is, why it is significant, why there is not an easy fix, and what most companies will do about it (prolly sue 'em or switch to Symantec) is more than a computer can do.

And I'm sure hedge funds are doing the math right now, trying to estimate the possible damages from lawsuits and how it changes the company's value. But remember, you don't have to beat the fastest hedge funds, you just have to beat most of the market, and you'll still make money. Anyway, it will be interesting to see what happens at market open tomorrow :)

dsplittgerber4• 16 years ago

True, in general principle. In this case, I disagree. MFE was down similar to S&P 500 yesterday. After opening today, not so anymore (-3.6% vs -1%). So market participants clearly did not incorporate the news into their immediate trading yesterday.

Also, whilst market participants watch news feeds, there is a clear difference between following news and trading the tape vs having an actual clue as to what a specific news item means in hard money for a company.

mrcharles2• 16 years ago

Just another nail in the coffin of the usefulness of AV systems. And good riddance.

My work computer actually has McAfee on it, which I've disabled through the registry. Don't like how slow it makes my computer.

Education, people! It's better than buying useless feel-good software.

watmough2• 16 years ago

I did some benchmarks on a Dell Precision M65.

The hit from MacAfee was approximately 15-20% by my reckoning, in terms of time taken to run a compile and link cycle.

Worse still, as you pointed out, responsiveness is affected, which can be incredibly frustrating.

daten• 16 years ago

With fake SSL certificates signed by "real" CAs, cross-site scripting and other advances in phishing attacks, just educating users may not be as effective as it used to be. Malware is quickly becoming advanced enough that even trained technical users may be fooled. Many attacks don't require user interaction. AV products may be slow to respond and signature matching won't catch everything, but if it catches half of what shows up on corporate networks it can still save a lot of time and money.

mrcharles2• 16 years ago

I wonder if the value of the total things stopped by McAfee, in all its time, outweighs the purported damage of this incident.

I'm thinking no.

billybob2• 16 years ago

I think it's interesting to consider computer viruses and biological pathogens in terms of "optimum harmfulness."

A cold virus's best strategy, for example, is to keep you awake coughing so your immune system is weak, make you sneeze and cough and have a runny nose so you spread germs, etc. But it shouldn't kill you, especially not before you pass it on. I've heard (did I read it in Guns, Germs and Steel?) that syphillis used to be more deadly, but that it got milder as an adaptive strategy.

Likewise, computer viruses probably have a pain threshold they shouldn't pass. If they can do their masters' bidding without hacking you off so bad that you format the computer, they'll be more successful.

Possibly unwarranted conclusion: computer viruses are now widespread precisely because they're Not That Bad.

So, are they worse than antivirus software? A lot of non-geeks may be asking themselves that question today. "Dang, we got a virus one time, but it didn't keep the computer from BOOTing!"

McAfee has just demonstrated a computer autoimmune disease.

Periodic2• 16 years ago

Viruses used to be largely statements and annoyances, the sort of thing a rebellious teenager would pursue as a form of computer vandalism.

Then people realized there was money in botnets and password stealing. The goal of those viruses is to get onto your computer and stay there as long as possible. If you notice it, you'll remove it, so it is in their best interest to avoid being noticed.

Unfortunately, a lot of them are so poorly written they are hard not to notice.

thaumaturgy3• 16 years ago

Well, first off, I have bad news for you: the more recent rootkits we've been seeing are doing exactly this. They are very quiet, very sneaky, very hard to remove, and they just love it when you purchase items online.

As far as whether viruses or antivirus software are worse to deal with -- well, I have three systems in the shop so far today for virus infections that were so bad that it rendered the computer unusable. One woman told me she broke down and cried because her brand new laptop got infected yesterday and quit working just before she was supposed to do online college course work.

Running without A/V software is exceptionally stupid at this point, even if you think you're smarter than everyone else.

wglb• 16 years ago

To computer viruses and biological pathogens, add virus scanners--that model holds. For example, if this incident causes sufficient negative publicity for McAfee, then perhaps it could disappear.

Does anyone recall the Michelangelo virus? One of the virus detection programs special release for that wiped the boot sector of every drive it was installed on. I think it is fair to say that in that case, the anti caused more monetary loss that the virus.

ggchappell• 16 years ago

> McAfee has just demonstrated a computer autoimmune disease.

My goodness, what a fascinating idea. (And a search suggests the you are the first person in all of history to think of that.)

When will the biological parallels end? Will we someday get viral transmission of OS code snippets from one machine to another, leading to improved OSs? The mind boggles ....

dustingetz• 16 years ago

not all malware requires user permission to execute -- modern web malware uses a browser exploit to run itself, you and i probably wouldn't realize it.

dfranke• 16 years ago

So they've finally identified Windows as a virus? About damned time.

jswinghammer2• 16 years ago

I don't understand why people install antivirus software on their machines. I read once that their catch rate is something like 20-30% which strikes me as no better than 0% for all the good it does most of their customers. It just seems to slow down computers a lot and yield little benefit other than protection for the IT staff when things go wrong.

I could make antivirus software that does nothing and probably make people happier by virtue of the fact that I'm not taking their system's resources.

goodmitton• 16 years ago

I don't understand how even having a 20% detection rate isn't better than 0%. Am I missing something? Are there a lot of viruses popping over the net that even the 20% detection is already too late?

jswinghammer2• 16 years ago

Given the cost in equipment purchases, user annoyance, lost productivity and purchasing the software itself it strikes me that you need much higher success rates to be worth all that.

dirtbox2• 16 years ago

The 20% figure that was "once read" about is pure fiction. Any up to date test figures reveal something closer to 99.8% of a 3 million sample testbase for the better AVs.

It's all a bit moot though as before this happened, McAfee was probably worse than anything a PC can get infected with. Now it's gone and proved it beyond any doubt.

mattmaroon• 16 years ago

You read Hacker News, which means you probably know more about computers than at least 99% of the population, and far more than 98%. Seriously, consider that.

Take something you don't know about. For me it's cars. If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right?

This is what people are told: Windows is insecure and anyone with a clue can just steal your credit card number. I know that if I just don't install crap from the internet, and have a reasonable firewall, I'm not going to get a virus. I haven't had antivirus in over a decade, though I've run some web-based ones on occasion to check, and have never had a problem. I know that, and you know that. My dad (who is much closer to the other 98% of the population) doesn't know that.

(As for corporate use, you answered your own question. IT staff installs it for no reason other than to be able to prove to their boss that it isn't their fault when stuff goes wrong. )

ominous_prime• 16 years ago

> If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right?

Oh, you mean "The Club", which slows down a car thief by about 10 seconds ;)

Periodic2• 16 years ago

For the IT staff, the fact that your computer slows down is an externality; it is not their problem. If the anti-virus can catch a few viruses and doesn't result in many help-desk tickets, then it makes their lives easier. Cleaning up a virus is a tedious task, as even a simple re-imaging can take a while, and that's if you can use a standard image.

They also don't know how smart their users are. Some of them are great, and might read HN, but others will go download any game or smiley pack they can find.

If IT staff were paid based on how smoothly the computers run, they might have a different opinion. Their current goal is usually just to make sure it runs at all.

FlorinAndrei• 16 years ago

Or you could just install the free AVG, the cost is zero (if money is what worries you), the impact on performance is negligible (I do photo and video processing, the antivirus doesn't seem to make Vista slower than it already is), and it's definitely better than nothing (caught a few cockroaches trying to sneak into my system already).

But what do I know, my laptop is running Ubuntu, my primary desktop has always been Linux since 1997.

azim• 16 years ago

The fact that you're here means your computer is working, but just in case anyone you know needs the instructions to disable McAfee:

Boot the affected client into Windows Safe Mode with Networking (Hit F8 During the system boot phase.)

Disable the McAfee McShield service by opening the Registry Editor (regedit.exe), and set the McAfee McShield service to the Disabled startup type: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\McShield\Start=4.

Once you've rebooted in to normal mode you can rollback definitions from the McAfee gui.

postfuturist• 16 years ago

http://xkcd.com/694/

jules• 16 years ago

I had this same problem with AVG on my parents' PC some time ago: it deleted an essential system file, making the computer unable to boot even in safe mode. I then did what they said that I should do, thereby fucking Windows up completely. Luckily I was able to recover important files via Ubuntu.

tumblen• 16 years ago

Crazy to think about the consequences of a mistake like this. This was sent by a friend to an email list I'm on:

"Well, consider this community hospital fubared.

IT dudes running around pulling out their hair. If it wasn't affecting patient care it would be a humorous scene-but I can't check xray's, or labs or anything. Took out a horrendously bloody gallbladder this morning, and I can't tell (labwise) if she's still bleeding...not good."

billybob2• 16 years ago

Wow. Kinda makes me wonder if we should be using general-purpose computers for so many things. The anti-virus is kind of a major single point of failure for machines that need to do just a few specific things.

chbarts• 16 years ago

Best Practices, n.: Making the same mistakes everyone else does.

However, what are the odds of someone being able to make special-purpose machines to do everything COTS boxes are used for, and making those machines as fast, cheap, and reliable as COTS systems are now? Some things seem obvious (x-ray machines, lab machines) but accounting and record-keeping? Going back to adding machines and purely manual filing is not an option in a large hospital, especially if it has to maintain modern standards of patient care over a large patient population.

cookiecaper2• 16 years ago

I don't think we need to move to special machines, we just need to move to sensibility in choices. Why do these need to be running Windows? Even if they're running Windows, why do they need an antivirus? Are you letting people on attachments from their email or browse the internet on the same box that you're using to read X-rays and other medical imagery? Kind of weird to do that, right?

I need to think about how to exploit this to promote the installation of *nix-based systems and get people to hire my company to do it.

joezydeco• 16 years ago

It'll all move to thin clients and the cloud. Just watch.

Not saying it's better, and in fact it'll be worse. The net goes down way more than the AntiVirus gets a bogus config file. But you'll see cash-strapped facilities get sold on the idea of cheaper clients on-site and a large server with a juicy maintenance package behind it.

azharcs• 16 years ago

reminds me of this funny XKCD http://xkcd.com/463/

houseabsolute• 16 years ago

A better solution is to disable all kinds of automatic updating on computers you manage and canary changes on just a couple of machines first.

thaumaturgy3• 16 years ago

I don't have time to counter all the misinformation here. Just a couple quick points:

- McAfee has been crap for a long time now; they're not much better than Norton's products from the last few years.

- Corporate networks are running McAfee because McAfee (and TrendMicro, and other garbage a/v vendors) provide incentives to VARs, consultants, resellers, etc.

- However, this is a far cry from "all antivirus is bad". There are plenty of good products available, some of them are free, and they don't have serious negative impacts on system performance. The on-demand catch rating of some of these products exceeds 97% in independent lab testing, which is pretty damn good.

- If you use a company computer, and you have disabled antivirus on your system because you don't like it, you are putting not just your company's computer, but your company's network at risk. In most "serious" companies, this would be grounds for termination, and I don't blame them. I would also like to emphasize that the workstation you use belongs to your employer, not you.

- I don't care how smart you think you are, if you're running Windows, you're at risk. Even current versions of Firefox are vulnerable to remote exploits, and we've been seeing a hell of an uptick recently in website infections. That blog that you've been visiting for years might try to hit your computer with something nasty tomorrow, and you'll never even notice. For that matter, a lot of website administrators don't realize they have a problem for a long time.

- Rootkits are getting very quiet and very sneaky. I think we're starting to see a trend where computers are coming in with a couple of different infections: one is a recent rogue antivirus infection which drives the user to get help, and the other is an older rootkit that's been running quietly in the background for a while.

You guys should know better.

doki_pen• 16 years ago

First off, I don't claim to be an IT person or know what normal users need to be safe. I can only speak to my personal experience as a programmer. I haven't had a virus in 14 years. I haven't ever run anti-virus software. I have a good feel for all the systems that I use. A little paranoia goes a long way. Not to say that I couldn't be targeted. I'm sure a skilled cracker could break my boxen. But I doubt any antivirus would stop them.

proee• 16 years ago

"I haven't had a virus in 14 years. I haven't ever run anti-virus software."

Then I'd say you probably have a virus ;-)

itgoon• 16 years ago

> I haven't had a virus in 14 years.

That you know of.

I can say the same thing, but I always put in that little caveat at the end. Same for being hacked. I've looked for evidence, and never found any reason to believe otherwise.

I've done too many cleanups for people, for whom I have the upmost respect, who said similar things for me lose my humility on that score.

tsally3• 16 years ago

Speaking as someone who knows something about these things, it is clear that you are not as informed as you are making yourself out to be. There are two reasons why I say that. (1) Your knowledge of the AV industry is outdated. McAfee has actually been trending upwards in recent years. (2) A 97% detection rate is obviously bullshit. If any product achieved a detection rate anywhere close to that number, the false positive count would be through the roof. As this incident makes clear, the cost of a false positive can be astronomically high. Again, any AV product advertising or claiming 97% detection is bullshit. Any AV engine can achieve that number if accepts an unrealistic number of false positives. The fact that you even quoted that number makes me question your qualifications for giving advice about AV.

For non technical people reading this thread, the general sentiment of other commentators is correct. Most AV is garbage. It will protect you from about a 1/3 of what is out there at the cost of computer performance. Make an educated decision about whether to run it at home or not. On your corporate network, do whatever your security guy tells you to do.

thaumaturgy3• 16 years ago

Not that I'm all that interested in getting into a pissing contest with Some Guy From The Internet, but:

1. I've been doing virus and malware cleanups for people since -- well, since 1995 or so, at least.

2. I've recently begun presenting seminars on basics for novice computer users.

3. I was among the first to clean up the rather nasty kbiwkm rootkit a while back. One of my clients was infected with it before there had been an a/v response, and before anything could be learned about it anywhere.

4. I've recently begun to get contacted internationally (well, from Canadian individuals, anyway) to clean up websites infected with various sorts of nasty bugs.

5. Most importantly, I follow the results and reports from av-comparatives.org religiously; they're not affiliated with any particular antivirus vendor, product, or group, their tests appear to be very thorough, their methods appear to be fairly rigorous, and they provide reasonable results for a number of different metrics related to antivirus products, all in a regularly-released report that's quite readable.

6. I started a company three years ago to address the various flaws that I saw in the I.T. industry, one of which was the number of people that got hit with viruses over and over again. I have a very, very low rate of repeat virus cleanups for my clients, many of whom are novices that are particularly susceptible to multiple computer virus vectors. You might feel like being snarky and saying that I never hear back from them because they don't care for the service, but then again, I'm currently experiencing my third straight year of 300% growth, and most of my "marketing" comes from word-of-mouth.

But, I don't have a blog, so of course I'm not an expert. Carry on.

edit: ohbtw, two of today's systems that were infected with rogue antivirus also had up-to-date and active McAfee installations, which isn't at all unusual. But, yeah, you're right, it's much better now than it used to be.

jwecker• 16 years ago

If I'm reading this report right there are several that hit 97% with low false positives. http://www.av-comparatives.org/images/stories/test/ondret/av... The methodology is linked in the document. I mean, it's certainly at least less of a conjecture than your "he doesn't know anything because these things are obviously BS" argument.

kentosi2• 16 years ago

"- There are plenty of good products available, some of them are free, ..."

Care to list some please? I don't use Windows, but I'm sick of my dad's PC being infected by the "Windows Security" scam application every 4 months. Not to mention the set of other viruses I find when trying to clean it up...

noonespecial2• 16 years ago

AVG is good

http://free.avg.com/ww-en/free-antivirus-download

ClamAV for windows is ok too:

http://www.clamwin.com/

Hell, just running housecall once in a while manually can do wonders:

http://housecall.trendmicro.com

xpaulbettsx• 16 years ago

Microsoft Security Essentials. It's free and it's the fastest and most thorough AV solution.

http://www.cnet.com.au/microsoft-security-essentials-3392988...

Daniel_Newby2• 16 years ago

Why does AV software not have a secure checksum-based whitelist? It is not as if Microsoft keeps the important system files secret.

jxcole2• 16 years ago

For that matter, why didn't they test this on at least one machine before releasing it? Is it not standard to have a release process that includes testing?

adamsmith• 16 years ago

Not to mention incremental roll outs, which would have caught this problem before it hit every win xp machine.

zmmmmm• 16 years ago

A guess: presumably whatever checksum they invent will have a severe risk that hackers will reverse engineer it and then devote their vast botnets to manufacturing virii that give the same checksum thus handing them even more control.

Daniel_Newby2• 16 years ago

There are secure hash algorithms and message authentication codes that are extremely secure.

Jd• 16 years ago

Anyone think that this might be an ingenious hack by a "virus" writer? Instead of targeting the computer, target the manufacturer that makes the code that is supposedly protecting the computer. If so, I'll bet all it took was one line in one list of malicious files.

No one may have thought to protect those back doors...

Qz• 16 years ago

The anti-virus scam strikes again!

Hexstream• 16 years ago

"- Don't worry, Skynet will take care of the virus in no time.

- Skynet IS the virus!!!"

alecco• 16 years ago

Some virus guy wrote about the problem of the economic model of major antivirus vendors. Corporate profit interest go against making a decent long lasting antivirus and instead benefit from incremental constant updates. That's why they mostly avoid behavioral analysis and localhost security checks. Instead they just use brute force pattern matching and constant updates.

A subscription model is detrimental to users' security. But try to explain that to your PHB who reads websites and magazines making money on advertisements from the industry.

McAfee quarantines svchost.exe on millions of WinXP machines worldwide

Related Stories