Get Smart about Business Spending
- Related Stories
-
Auditor loses McAfee employee data
February 23, 2006 -
Microsoft announces Office 2007 pricing, details
February 15, 2006 -
Microsoft flagged Symantec software as spyware
February 13, 2006 -
Microsoft security zaps laptop tracer
December 14, 2005
An error in McAfee's virus definition file released Friday morning caused the company's consumer and enterprise antivirus products to flag Microsoft's Excel, as well as other applications on users' PCs, as a virus called W95/CTX, Joe Telafici, director of operations at McAfee's Avert labs, told CNET News.com.
"At about 1 p.m. PST we started getting reports that people were seeing an unusual number of W95/CTX infections in their environment," Telafici said. "Files that we did identify would probably be deleted or quarantined, depending on your settings."
When a file gets quarantined, it's renamed and moved to a different folder. McAfee's antivirus software detected Excel.exe and Graph.exe, two Microsoft Office components, as well as other software, including AdobeUpdateManager.exe, an application installed alongside Adobe products that deals with software updates, Telafici said.
About 100 customers, individuals as well as corporations, reported the problem, Telafici said. McAfee, the world's second largest antivirus software vendor, rushed to fix the mistake. Consumers were automatically reverted to the older definition files at about 2:30 p.m. and an update was pushed to corporate users an hour later, he said.
The issue affected only desktop antivirus software, not McAfee's network-level products that scan e-mail, Telafici said. Also, the incorrect detection occurred only if the user ran a manual virus scan or during a scheduled scan, not during idle time or background scanning, for example, he said.
Such problems with security software are called false positives and they happen occasionally. McAfee typically has to do an emergency release of a virus definition file once every three months because of a false positive issue, Telafici said. "This is our once for the quarter I think," he said.
However, this time around it was a particularly big goof, because the company faulted Excel, Telafici admitted. "Usually, it is either custom applications or applications that did not exist at the time we wrote the signature file," he said.
McAfee has been able to pinpoint the cause of the problem and hopes it can avoid it in the future, Telafici said.
The problem occurred with virus definition file 4715, which was released at about 10:45 a.m. on Friday as part of McAfee's daily update cycle. The repaired, emergency-definition file 4716 was pushed out at about 3:30 p.m.
See more CNET content tagged:
McAfee Inc., virus definition, Microsoft Excel, virus, Microsoft Corp.
I think the issue is that the times mentioned in the article are PST, and I am in EST. Therefore, the final fix at 3:30 pm probably occured at 6:30pm on the east coast. Therefore, my 5pm download was of the bad definition file.
I forced a manual download and now I am on the fixed definition set.
Michael
Remove MS Office, there are no document viruses. Period.
Yes, I have heard of macro viruses for non-MS products. How about the several that showed up for Adobe's Acrobat for example?
You had better stop making this statement (yes, I've seen and ignored your previous misstatements) because it only makes you to be a fool.
I am writing to you regarding the error caused by McAfee on 03-10-2006, in reference to the 4715 update . I do not run Microsoft Office. However, I did use Adobe Acrobat version 6.0.2 and it must have tried to check for updates automatically. (incidentally, the last update on my computer for this progran was dated 05/11/2004). I accessed this program, Adobe, at 2:37 pm EST. At 2:39 pm EST, McAfee alerted me of a virus - W95/CTX.
Here is my problem with what McAfee says happened: I was NOT running a manual virus scan by McAfee at the time, nor was I running a scheduled scan - my scheduled scan was for 6:30 PM EST.
"The issue affected only desktop antivirus software, not McAfee's network-level products that scan e-mail,Telafici said. Also, the incorrect detection occurred only if the user ran a manual virus scan or during a scheduled scan, not during idle time or background scanning, for example, he said"
This is NOT what occurred on my computer at all! NO manual scan or scheduled scan was done when the virus alert popped up... this happened by itself two minutes after the launch of Adobe Acrbat 6.0.2, with no virus scan activity going on at the time, or in fact, that day at all! I had received the updates earlier in the day from McAfee, as I do receive automatic updates.
My OTHER problem with this article is that the "supposed virus" did not attatch to anything Microsoft on my computer, or Adobe Acrbat: it attached to a "dll" file in my Norton Ghost program. It affected this file: symlcrst.dll, which is located in C\programfiles\commonfiles\symantecshared\CCPD-LC\symlcrst.dll
I manually updated Mcafee after searching endlessly on the Internet for a clue to this problem. I finally found one hours after the error occurred, and downloaded the fix tool ( 4716 update), which is time stamped on my computer at 7:18 PM EST. I am not running a corporate version, by the way! However... the install time on this update was 8:04 PM EST, , and which WAS the time stamp with a date of 03/10/2006 for the file the virus attached to... my problem is that I am sure if or how this file was affected. When I started my computer today, this morning, 03/11/2006, @ 8:33 AM EST, the affected file updated to that time and date - today!!! I am not sure at this point if Norton Ghost changed that file time and date upon launch this morning, or if McAfee changed it!
I think people need to be made aware of the fact that a scan DID NOT have to occur, nor did it only attach to Windows Office files or Adobe Acrobat files This McAfee error attacked Norton Ghost, by Symantec! I am wondering why this occurred the way it did on my computer given McAfee's "official statement". My version of events as to how this affected my computer is easily verifiable on my system. I am wondering how many other people are not worried about this affecting their computers due to the wording of the McAfee statement.
Thanks for printing the article... McAfee's website, the numerous times I checked it during this event, did not at all indicate this was their error!!! I find this to be shameful and neglectful on the part of McAfee, and will discontinue service upon installation of a new virus program!
On Saturday, my hired geniuses had to reinstall stuff and reconfigure to tune of $250. After all this is New York.
As far as I'm concerned, McAfee did not do due diligence. They owed a mass mailing to all customers about this error as soon as it was known so we wouldn take actions that were unwarrented. Instead, all there was was their message that their business hours were from Mon-Fri and their tech service costs $2.75 per minute.
Since they made no effort to aliviate the trouble they caused so many, I feel they owe us damages. I'm sending them a copy of my bills for $250 and the bill for $100/hour I should have made in the office from Friday afternoon about 2:30 pm until Saturday at 5 pm when the problem was fully fixed.
I know it will end up in their round file, but hopefully a copy of this letter and the bills sent to the NYC Attorney General's Office Department of Consumer Affairs may have more effect.
Think I'm kidding? Google my name.
Monona Rossol
On Saturday, my hired geniuses had to reinstall stuff and reconfigure to tune of $250. After all this is New York.
As far as I'm concerned, McAfee did not do due diligence. They owed a mass mailing to all customers about this error as soon as it was known so we wouldn take actions that were unwarrented. Instead, all there was was their message that their business hours were from Mon-Fri and their tech service costs $2.75 per minute.
Since they made no effort to aliviate the trouble they caused so many, I feel they owe us damages. I'm sending them a copy of my bills for $250 and the bill for $100/hour I should have made in the office from Friday afternoon about 2:30 pm until Saturday at 5 pm when the problem was fully fixed.
I know it will end up in their round file, but hopefully a copy of this letter and the bills sent to the NYC Attorney General's Office Department of Consumer Affairs may have more effect.
Think I'm kidding? Google my name.
Monona Rossol
If any of the target files were in use or launched while 4715 was in place, the application was damaged.
They have also provided a utility to restore files, but if you are running Office 2000 as an example, replacing the file does not solve the problem. Office has to run a repair or a chaneg in setup to fix the problem.
Mcafee screwed up hard, and they are doing their best to make it look less severe of an issue than it is.
of viral threats, and less-than-effective responses to threats in
general.
Microsoft started the assinine ordeal by flagging Symantic's Anti-Virus falsely...
I guess that this shows Microsoft that more than ONE can play at the same game... (* ROFLOL *)
They had the balls to pull it off. Symantic is currently going through a similar Microsoft fallout rigamarole which McAfee's initially faced when Microsoft dropped them and chose Symantec over the previous Microsoft de-factor standard which used to be McAfees.
Albeit... I have no proof of this... I can just feel it in my bones... they're seeking their revenge on Microsoft for the dastardly deeds which Microsoft pulled on no only them but more recently Symantic as well... but the tactics they are using is what Microsoft had recently pulled on Symantec... (* LOL *)
Don't ya just love it when a plan comes together... (* ROFLMAO *)
Walt
In the past it has also added various antispyware applications to it's virus definition lists, calling them trojans or viruses.
--
Stan Oleynick, founder: http://www.enthem.com
purpose, but the sloppy programming and program testing is
McAfee's fault. And both Symantec and McAfee go to all lengths to
hype the threat and sell more low quality software.
I won't use products from either company.
HP OpenView Operations Agent (7.31)
HP Radia Client
Java 5 JRE
HP System Management Homepage (agent for HP Proliant Servers)
- Is not a virus...
- by March 13, 2006 8:55 PM PST
- Excel and other MS products are not virii.
- Reply to this comment
-
(38 Comments)By definition, a virus is a small piece of code that is highly efficient and performs its task quickly and more often than not, without error.