Barry McPherson
Executive Vice President Worldwide Technical Support and Customer Service
Barry McPherson is ...
|
|
In the past 24 hours, McAfee identified a new threat that impacts Windows PCs. Our researchers worked to address this threat that attacks critical Windows system executables and buries itself deep into a computer’s memory.
The research team created detection and removal to address this threat. The remediation passed our quality testing and was released with the 5958 virus definition file at 2.00 PM GMT+1 (6am Pacific Time) on Wednesday, April 21.
McAfee is aware that a number of customers have incurred a false positive error due to this release. We believe that this incident has impacted a small percentage of our enterprise accounts globally and a fraction of our consumer base–home users of products such as McAfee VirusScan Plus, McAfee Internet Security Suite and McAfee Total Protection. That said, if you’re one of those impacted, this is a significant event for you, we understand that and we’re very sorry.
Our initial investigation indicates that the error can result in moderate to significant issues on systems running Windows XP Service Pack 3.The immediate impact on corporate users was lessened for corporations who kept a feature called “Scan Processes on Enable” in McAfee VirusScan Enterprise disabled, as it is by default, though those customers could also be impacted when running a scan.
The faulty update was removed from all McAfee download servers within hours, preventing any further impact on customers.
McAfee teams are working with the highest priority to support impacted customers. We have also worked swiftly and released an updated virus definition file (5959) within a few hours and are providing customers detailed guidance on how to repair any impacted systems.
Corporate Customers
- This entry in our virus information library provides workarounds
- Our knowledge base has two articles, one specific for VirusScan Enterprise users and one for Total Protection Service users
- Customers are discussing the issue in our online support community
- More details on this topic are available in an FAQ.
Consumers
- This support page provides information for impacted consumers
- Consumers are also discussing the topic in the online community
To contact McAfee by phone in your region, go to the “Contact Us” page on our Web site and select your country for the correct number.
Early morning on Thursday night (at around 1 AM PT) we published a SuperDAT Remediation Tool to help customers fix affected systems. The tool suppresses the driver causing the false positive by applying an Extra.dat file in folder. It then restores the “svchost.exe” Windows file. The tool has been successful at remediating the problem caused by the faulty DAT update for multiple customers. The tool itself and more details on how it works are available in our knowledge base.
We are investigating how the incorrect detection made it into our DAT files and will take measures to prevent this from reoccurring.
We sincerely apologize for the inconvenience this has caused our customers and will update this blog posting as more details become available.
Barry
PS: I just published another blog in response to some of your comments below.
(Updated at 3.35 PM PT to include statement on number of customers impacted.)
(Updated at 3.50 PM PT with a link to details for consumers who were impacted.)
(Updated at 5.13 PM PT with link to knowledge base.)
(Updated at 5.44 PM PT to correct the number of impacted consumers.)
(Updated at 8.20 PM PT removing detail on 5959 DAT capabilities.)
(Updated at 9.27 PM PT to provide additional detail on customer impact added link to new blog post.)
(Updated at 10.01 PM PT to add a link to the support community.)
(Updated at 11.58 AM PT on Thursday to add additional KB article links.)
(Updated at 1.10 PM PT on Thursday to add mention of remediation tool.)
(Updated at 2.45 PM PT on Thursday to restate number of customers impacted.)
(Updated at 12.53 PM PT on Friday to add a link to the FAQ.)
Major disaster for me in UK. No internet access, so know way of knowing what the problem was.
Lucky I had backed up using Genie Pro 8.
Restored winxp pro in 40 minutes but lost important email.
Spent remainder of day rebuilding CAD software on PC. Self employed so no one pays me for this.
Mcafee I suggest you tell the *truth* not waffle.
We engineers have to.
my personal computer was destroyed by this virus and I am a Mcafee customer. I have talked to numerous McAfee employees and all don’t seem to know what to do or we are unable to communicate and they don’t seem to understand my problem. (I asked to speak to their supervisor but this did not happen. So, what is one to do?)
As a result of this, and trying to get my computer fixed I somehow was connected to another company that corrected the problem, but I had to pay for the fix now I want my money back from McAfee. If I do not get satisfactory results, I will drop McAfee as my security supplier. Too, I hope someone will initiate a class action law suit against McAfee.
That is all I have to say at ths time.
UNBELIEVABLE!!!!! I have used Avast for many years without any problems. It was suggested I use McAfee. I switched over – what a mistake. I had to pay $10.00 when I called in to get help just so I could talk to someone. I was told, that everything was fine. I have just spent the last three days on the phone with India….I had to erase everything and reformat. It still isn’t working right. I don’t have time for this. I had to pay Dell $200.00 to help me. I will be taking this to small claims to be reibursed. How about a class action suit? Include me in. I’m going back to Avast. Mcapee owes me money and an apology!
I have a suggestion to McAfee to save face and reputation – offer us all a whole year free antivirussubscription. I mean, it wouldn’t mean much to McAfee, would it? We misfortunate are only half a percent of the McAfee business, right? If I don’t get some compensation I will switch to something else!
The only way I could fix mine, to get access to the task bar and ‘start’ button was to use the Windows distribution disk to repair the operating system (DON’T choose the first ‘R’ option – you’ll get another chance to ‘Repair’). You’ll need to boot off the distribution disk, maybe needing to change the boot order in the BIOS as I did. NOW you’re working, but probably with SP1 or SP2, depending on how old you computer is, so plan on spending hours to let Windows upgrade back to SP3. Hope you can find the Windows re-install distribution disk, or created a rescue disk when you bought your computer!
After 2 days and $250 that a retiree can ill afford, I find that McAfee caused its own problem. As I was unable to access the internet, I was unable to correct5 the problem with the published “fix”, hence the $250 charge – Our security suite is due to be updated in May, and you can bet it will NOT be with McAfee unless they do something to reimburse me!
First of all I had to pay $10 to talk to someone to get help because their posted fixes did not work on my computer. After spending $125 to get my computer fixed by a professional I called McAfee to cancel my subscription which expires in October. They cannot even give me a partial refund of my balance. Even in a major publicity crises you would think that some good PR for those affected would be a olive branch. They just lost a customer permanently.
I’m running Vista and downloaded an extremely problematic update from McAfee yesterday FRIDAY, APRIL 23. Immediately following the McAfee update my machine began behaving strangely: keyboard and/or mouse not working, system locking up, applications freezing while opening. I have used MS system restore to return to pre-McAfee update status and still have these update-related issues. Whatever this McAfee update did the screw up my system–it has done so royally. So, I am not at all convinced that of McAfee’s assertion that this is an XP-related bug only. The fact that there is still no admission of this-let alone a fix- is really distressing.
Oh, and p.s. as another Vista/McAfee user pointed out, I am very, very familiar with discovering that my McAfee firewall has somehow been disabled -for God knows how long- and needs to be manually restarted. I am very, very close to dumping McAfee–for good.
I’m removing McAfee after reading these comments.
I have a year left on my subscription, and I am still switching to Norton 360. Your apology is every bit as good as your software.
I just spent eight hours I could have wasted having a life dealing with this nonsense; it’s so lovely that you’re very sorry. I have a year left on my McAfee sub, but I am switching to Norton 360.
Your company, Mr. McPherson, gives incompetent twits hope: as long as you exist, they know that they are not the least functional people on earth.
I cannot do a system restore, or even open up the McAfee to check the DAT version and i think that it affected my Windows XP because I have lost my local area connection and cannot even access the internet to get the upgrade for the DAT.
The wanted to charge me 90 bucks to fix their error. WTF???
One thing I have recommended to friends, family, and anyone else that would listen is to never buy a package or use the same anti-virus program for all the computers in the SAME home because one incorrect security patch could disable all the computers and prevent them from saving money to search for the online help on their own. I use Free Avast Home and MS Security Essentials instead of McAfee even though COX cable offers it for free (a $69.99 value they tell me, ROFLMAO!) as a home security suite. Unlike others on this site I intend to go back to it after this fiasco (had it on the Windows Home Server in the past but removed it due to slowdown), because now McAfee will be on pins and needles having to watch their Ps and Qs. After this PR nightmare I expect your company can not afford two within a short window of tolerance.
I keep a few versions bootable Linux by CD and pendrives (Knoppix, Ubuntu, and Puppy) as well for troubleshooting, maybe you should offer something similar as a company. A downloadable bootable image that would allow the users to get online and download self-installing patches would go a long way to restore faith in many of your customers. I know AVG offers this option though it does have the limitation of needing a wired connection. On my two main machines I also have set them up as a dual boot system in the event of this nature, Ubuntu makes it easy with wubi and will allow people to get online, search for solutions, download files, and even apply them to the drive but nothing states that you can not offer your customers the same.
I think it is foolish to only have one machine without an external backup, backup plan from a different OS, or other means to save important data and don not feel sorry for anyone who lost information or business over this because you should never rely just on one solution. I also don not feel sorry for those businesses that only used or deployed one antivirus solution for their corporate network. I don not even own a business and have multiple contingencies in place of this nature and wishes to know which businesses did fail due to this and would name themselves so I may avoid them all in the future. Computer information can be lost in so many ways such as user error, malicious intent to damage it, theft, natural disasters, and hardware failure but worst of all by those who seem to trust in too few to do so much for them.
Harsh? Of course it is, but one of the harsh realities of life is that a customer does not have to buy into the excuse of the business whether it is McAfee or those that only used one antivirus program for their corporate solution. If I lost a family member in the hospital due to this error I would not just blame McAfee, but the hospital as well for deploying this in the field without their own proper testing on their end, as well or to have a backup in the event the main item failed. While I don not think this absolves McAfee, who should take a majority of the blame, it should also make all IT departments speak out to the bean counters that putting all of their egg in one basket is rarely a good idea.
McAfee can provide us with the real numbers, after all they should know exactly how many machines have this installed, what OS is on them, what version of the OS, and how many percent of those downloaded the patch because this would tell us exactly how many machines could have crashed. I would like McAfee to be a little more more precise because they can.
Why the hell did anyone ever install McAfee on computers anyway? I have never heard anything good about McAfee, I have always avoided it like the plague. This problem right here is why I am glad that I have Symantec. It may not be the best, but at least it does not crash all of my computers. If you dont want to use Symantec, there is always SOPHOS. I would recommend switching as soon as you can.
Why the hell did anyone ever install McAfee on computers anyway? I have never heard anything good about McAfee, I have always avoided it like the plague. This problem right here is why I am glad that I have Symantec. It may not be the best, but at least it does not crash all of my computers. If you dont want to use Symantec, there is always SOPHOS. I would recommend switching as soon as you can. Sorry about your computers.
I cannot get my PC to do ANYTHING! McAfee is responsible, McAfee needs to pay to have my PC repaired!
man up and admit your stupid mistake. forget the excuses. I work for intel and you caused great havoc here. your product sucks and so does your customer service.
This man has not idea what he is talking about, in my company affected more than 10000 computers, mcafee sucks, And for MR BRENT maybe he is a home user , this man must be from mcafee too, they just do not accept what they did..period
Great, my Mcafee Internet Security is often reporting that the firewall has been shut down and i need to turn it on manually myself…
What is this????
Is this the result of the faulty update or another problem with Mcafee IS 2010 on Vista?!
Submit your own comments / message for this post