An update to Microsoft Security Essentials, the software company’s free anti-malware software, crashed Windows XP computers last week, causing business disruptions to customers still relying on the outdated—and, in many cases, now-unsupported—operating system.
The update caused a variety of Microsoft operating systems to restart and then fail to reboot, displaying an arcane “MsMpEng.exe application error” message, according to online posts by affected users.
Many point-of-sale systems, which some businesses are protecting using Microsoft Security Essentials (MSE) as a way to meet the antivirus requirement of the Payment Card Industry PCI), still use Windows XP or related operating systems, including Windows XP Professional for Embedded Systems and Windows Embedded POSReady 2009. Those systems were affected by the update as well, according to one New England value-added reseller with more than 500 clients in the hospitality industry.
While Microsoft corrected the issue within days, the bug crashed at least hundreds of machines. For the New England firm, the issue affected more than 250 machines at 50 customers who relied on the systems, a consultant at the company said on condition of anonymity.
“This affected about one half of our customers running Windows XP,” he told eWEEK. “This brought their business to a 100 percent standstill until we could resolve the situation. In a pinch, the only solution we could determine was to uninstall MS Essentials to get them running their business again.”
While uninstalling Microsoft Security Essentials worked around the issue, it also caused an additional problem: Even though Microsoft later fixed the update, MSE could not be reinstalled on Windows XP computers because the systems are no longer supported by Microsoft, the source said.
The problems came just over a week after Microsoft’s scheduled end of support for its 12-year-old Windows XP operating system. Standard desktop users will no longer receive updates for their systems, and Microsoft urged businesses and consumers to upgrade. However, the Windows XP versions for embedded and point-of-sale systems continue to be supported, according to the software giant. The incident shows, however, that there are holes in such support.
“We were all told that Microsoft Security Essentials would be updated through July 15, 2015, no problem,” one IT administrator stated on Microsoft’s Community forum. “Now there are constant nag messages about your operating system not being supported, a red antivirus taskbar icon so you can’t tell if you are being nagged or have a virus. And now this bug, which even caused me to pause and wonder if XP machines are actually in the process of being attacked.”
Microsoft declined to comment specifically on the issues, except to confirm that a problem did exist with the update to Microsoft Security Essentials and it had been fixed. The company’s statement, however, did not acknowledge any major support issues caused by the update.
“On April 15, 2014, Microsoft released an Antimalware Engine update that may have caused interrupted service for customers using affected Microsoft security products,” the company stated in an April 21 email to eWEEK. “Microsoft corrected the issue via signature update, which automatically resolved the issue, and customers do not need to take any action.”
While business customers have long been urged to end their reliance on Windows XP, many cost-conscious firms are trying to avoid upgrading.
“One can say the customers got what they paid for, as MS Essentials has no charge and is bundled with the operating systems,” the New England technology provider said. “Our customers are small, overly cost-conscious folks that use the lowest-cost solutions available to them when possible.”