quote:

---

IT admins across the globe are letting out a collective groan after servers and PCs running McAfee VirusScan attacked core system files, in some cases causing the machines to display the dreaded blue screen of death.

Details are still coming in, but forums here and here show that it's affecting McAfee customers in Germany, Italy, and elsewhere. A UK-based Reg reader, who asked to remain anonymous because he was not authorized by his employer to speak to the press, said the glitch simultaneously leveled half of a customer's 140 machines after they updated the latest virus signature file.

"Literally half of the machines were down with this McAfee anti-virus message IDing valid programs as having this trojan," the IT consultant said. "Literally half the office switched off their PCs and were just twiddling their thumbs."

When the consultant returned to his office he was relieved that his own laptop, which also uses VirusScan, was working normally. Then, suddenly, when it installed the latest McAfee DAT file, his computer was also smitten. The anti-virus program identified winvnc.exe and several other legitimate files as malware and attempted to quarantine them. With several core system files out of commission, the machine was rendered an expensive paperweight.

A McAfee representative in the US didn't immediately respond to phone calls seeking comment. Friday is a holiday for many US employees in observance of Saturday's Independence Day.

Based on anecdotes, the glitch appears to be caused when older VirusScan engines install DAT 5664, which McAfee seems to have pushed out in the past 24 hours. Affected systems then begin identifying a wide variety of legitimate - and frequently crucial - system files as malware. Files belonging to Microsoft Internet Explorer, drivers for Compaq computers, and even the McAfee-associated McScript.exe were being identified as a trojan called PWS!hv.aq, according to the posts and interviews.

We're still trying to determine how widespread this false-positive glitch is being felt and whether people have found any reliable fixes.

---

said by dandelion :

Wouldn't it have been a better business practice to send a warning that new data is likely to cause severe crashes etc. if the program is not updated?

said by McAfee :

---

After 1st February 2008 the 5100 McAfee Anti-Virus Engine will no longer be supported. In order to continue to receive support on McAfee Anti-Virus products users will need to upgrade to the 5200 version of the McAfee Anti-Virus Engine before this date.

From 1st February 2008 onwards there will be no further Anti-Virus definition files (DAT file) quality testing with the 5100 McAfee Anti-Virus Engine. Also, new detections and cleaning by the DAT files will be written with focus on the new enhanced capabilities of the 5200 McAfee Anti-Virus Engine where appropriate.

---