eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Anti-virus powerhouse McAfee was left wiping egg from its face after shipping a virus definition update that incorrectly flagged hundreds of legitimate software programs as a low-risk virus outbreak.
McAfee, of Santa Clara, Calif., released the erroneous .DAT file 4715 with definitions for a wide range of new malware threats. When the update was installed, it quarantined or deleted hundreds of innocuous—and important—applications, including Microsoft Excel, Adobe Systems Macromedia Flash Player and Adobe Update Manager, and Googles Google Toolbar installer.
The gaffe caused the software programs to be flagged as W95/CTX, an obscure Microsoft Windows 95 virus first detected in 2004.
A company spokesperson said the error was quickly noticed and corrected with a new virus pattern file (.DAT 4716), but, for some enterprise users, the damage was already done.
The faulty .DAT 4715 file caused problems for customers running McAfees VirusScan Enterprise, Managed Virus-Scan VirusScan Online, LinuxShield and VirusScan (consumer) products. Customers using McAfees OAS (On-Access Scanner) were not affected.
The issue caused major chaos in businesses that set the anti-virus program to automatically delete threats.
Johannes Ullrich, chief research officer at the SANS ISC (Internet Storm Center), said his outfit has received reports of major damage in some corporate settings. “Weve fielded reports about hundreds of files quarantined or deleted on hundreds of computers. If you had your anti-virus set to quarantine detections, you can restore those files, but its a huge task,” he said.
“Its difficult to gauge how many businesses were affected, but in some cases, we know that some administrators had problems affecting thousands of systems. It was rather severe because it deleted these programs,” Ullrich said.
In a statement, McAfee officials said the companys AVERT (Anti Virus Emergency Response Team) has been working “around the clock” to help customers assess the degree of impact and restore the files where possible.
The statement also said the companys Managed VirusScan and VirusScan Online have quarantine viewers that allow for restoration of quarantined files.
For VirusScan Enterprise customers, the spokesperson confirmed that the ability to remotely restore files does not exist in the product.
McAfee has released a stand-alone tool that restores quarantined files for VirusScan Enterprise users. The tool, which is available only for non-East-Asian operating systems, can be deployed via ePO (ePolicy Orchestrator), McAfees system security management product.
The spokesperson said AVERT is working on a recovery tool for users of Chinese, Japanese and Korean operating systems. “AVERT is also looking into whether we can create an Undelete tool for those customers who had their secondary action set to Delete,” she added.
McAfee isnt the first anti-virus vendor to struggle with quality of definition updates. Last April, Trend Micro released a faulty virus pattern file that resulted in higher-than-normal CPU consumption, causing system slowdowns and problems for some customers.
In Trend Micros case, the problems were more disruptive because one of the patterns within the update caused as much as 100 percent CPU utilization, with the potential to lock up users machines. The faulty update was available for roughly 90 minutes.