Recovering from the Flawed McAfee Update

Nothing ruins an IT administrator's day faster than a software update from a security vendor wreaking havoc on the computer systems it is intended to protect. That is exactly the predicament faced by many IT administrators today when a flawed McAfee update rendered Windows XP PC's essentially useless.

Joris Evers, a McAfee spokesperson, e-mailed a statement explaining "In the past 24 hours, McAfee identified a new threat that impacts Windows PCs. Researchers worked diligently to address this threat that attacks critical Windows system executables and buries itself deep into a computer's memory."

Evers continued "The research team created detection and removal to address this threat. The remediation passed our quality testing and was released with the 5958 virus definition file at 2:00 PM GMT+1 (6am Pacific Time) on Wednesday, April 21."

Not long after that, reports began to surface that Windows PC's--primarily Windows XP SP3 PC's--were experiencing significant issues, including constant rebooting or the ever-popular BSOD (blue screen of death) system crash.

A number of customers experienced a false positive resulting in the ensuing chaos. The 5958 virus definitions apparently detect svchost.exe--a core system file on Windows PC's--as a malware threat. According to the McAfee statement, though, "corporations who kept a feature called "Scan Processes on Enable" in McAfee VirusScan Enterprise disabled, as it is by default, were not affected."

McAfee responded by quickly pulling the faulty update from the McAfee servers. An emergency extra.dat file was made available in the McAfee forums to address the issue, but the forums site was so overwhelmed with customer backlash that it was eventually taken offline. A corrected virus definition file--5959--is now available, and McAfee has posted instructions to recover affected systems.

Evers summed up with an apology to affected customers and the following mea culpa "We are investigating how the incorrect detection made it into our DAT files and will take measures to prevent this from reoccurring."

Identifying Affected Systems

Obviously, if your Windows XP SP3 system is displaying a BSOD or constantly rebooting you have some pretty strong evidence that the system was impacted by the faulty McAfee detection of the W32/wecorl.a virus.

A spokesperson for Solera Networks pointed out via an e-mailed statement that not all affected systems are so obvious, and highlighted the fact that network threats often originate internally without malicious intent. "As with today's McAfee incident, security issues don't always come from outside hackers with malicious intent. They may originate from non-malicious activities from a trusted partner, such as McAfee."

The statement adds "Though it seems that cleaning up individual machines may be sufficient, there may be remnants of files and systems affected that are not apparent. As it has been continually reported, many security breaches and the damage they do remains on networks for days and months, or longer, going unnoticed. Even a trusted partner can be wreaking havoc beyond the visible scope into the network."

Recovering Affected Systems

Solera Networks' customers are using products like Network Forensics and scanning all network activity for any evidence of where the faulty DAT file crossed the network, who downloaded it, when and what happened thereafter, considering the whole network. Using Network Forensics, these companies effectively go back in time and can perform complete cleanup with full visibility to the entire network in minutes.

Speaking of going back in time, affected systems may be able to simply reverse the affects of the faulty DAT by using Windows System Restore. Restoring the system to a point in time prior to when the 5958 DAT was pushed out should effectively take the computer back in time and reverse the damage.

Perhaps there is another subtle message here, too. The systems crippled by the faulty McAfee update were Windows XP SP3 PC's. Perhaps it's time to upgrade to Windows 7?

Tony Bradley is co-author of Unified Communications for Dummies . He tweets as @Tony_BradleyPCW . You can follow him on his Facebook page , or contact him by email at tony_bradley@pcworld.com .