Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

McAfee quarantines svchost.exe on millions of WinXP machines worldwide

andreyf.tumblr.com

Post reply on HN
Print view View original

31–40 of 113 posts

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#31

Post by FlorinAndrei »

jswinghammer wrote: post #8

I don't understand why people install antivirus software on their machines. I read once that their catch rate is something like 20-30% which strikes me as no better than 0% for all the good it does most of their customers. It just seems to slow down computers a lot and yield little benefit other than protection for the IT staff when things go wrong. I could make antivirus software that does nothing and probably make…

Or you could just install the free AVG, the cost is zero (if money is what worries you), the impact on performance is negligible (I do photo and video processing, the antivirus doesn't seem to make Vista slower than it already is), and it's definitely better than nothing (caught a few cockroaches trying to sneak into my system already).

But what do I know, my laptop is running Ubuntu, my primary desktop has always been Linux since 1997.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#32

Post by iron_ball »

spamizbad wrote: post #24
andreyf wrote: post #17

Earlier quoted context omitted.

Unless the settlements are enormous, the market never will. Or if they lose big clients. My wife tells me all computers in PWC's NYC office are out.

Shame on PWC for not upgrading to Vista or Windows 7. A firm that large should have more foresight in IT planning.

I can't tell if that's sarcasm or not.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#33

Post by azim »

The fact that you're here means your computer is working, but just in case anyone you know needs the instructions to disable McAfee:

Boot the affected client into Windows Safe Mode with Networking (Hit F8 During the system boot phase.)

Disable the McAfee McShield service by opening the Registry Editor (regedit.exe), and set the McAfee McShield service to the Disabled startup type: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\McShield\Start=4.

Once you've rebooted in to normal mode you can rollback definitions from the McAfee gui.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#34

Post by GFischer »

Zev wrote: post #27
GFischer wrote: post #10

Earlier quoted context omitted.

A recent study linked here showed that frequent password changes were no good (can´t find the link right now).

The original post you're replying to was deleted, but, this comment interested me enough that I went and looked for the paper. It isn't up yet, but here's a writeup of it from the Boston Globe: http://www.boston.com/bostonglobe/ideas/articles/2010/04/11/... . The paper ( Please Continue to Hold: An empirical study on user tolerance of security delays ) is by Cormac Herley and a few others. All the other papers on Her…

Thanks, I'd read a writeup as well, not the original.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#36

Post by smallblacksun »

kalid wrote: post #30
dirtbox wrote: post #20

Earlier quoted context omitted.

The 20% figure that was "once read" about is pure fiction. Any up to date test figures reveal something closer to 99.8% of a 3 million sample testbase for the better AVs. It's all a bit moot though as before this happened, McAfee was probably worse than anything a PC can get infected with. Now it's gone and proved it beyond any doubt.

The 99.8% includes a known test set for historic viruses from the 80s and 90s. The stuff you really care about are the new things that sweep the web (Blaster, Slammer, Code Red, etc.). AV is inherently reactive, and that .2% you miss is likely the latest stuff.

Old (meaning a year or two) viruses are still around, and can still do a lot of damage. A large part of the reason they don't is because people run virus scanners that catch them, and stop them from spreading.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#37

Post by ominous_prime »

mattmaroon wrote: post #25
jswinghammer wrote: post #8

I don't understand why people install antivirus software on their machines. I read once that their catch rate is something like 20-30% which strikes me as no better than 0% for all the good it does most of their customers. It just seems to slow down computers a lot and yield little benefit other than protection for the IT staff when things go wrong. I could make antivirus software that does nothing and probably make…

You read Hacker News, which means you probably know more about computers than at least 99% of the population, and far more than 98%. Seriously, consider that. Take something you don't know about. For me it's cars. If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right? This is what people are told: Windows is insecure and anyone with a clue c…

> If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right?

Oh, you mean "The Club", which slows down a car thief by about 10 seconds ;)

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#38

Post by jules »

I had this same problem with AVG on my parents' PC some time ago: it deleted an essential system file, making the computer unable to boot even in safe mode. I then did what they said that I should do, thereby fucking Windows up completely. Luckily I was able to recover important files via Ubuntu.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#39

Post by billybob »

mrcharles wrote: post #4

Just another nail in the coffin of the usefulness of AV systems. And good riddance. My work computer actually has McAfee on it, which I've disabled through the registry. Don't like how slow it makes my computer. Education, people! It's better than buying useless feel-good software.

I think it's interesting to consider computer viruses and biological pathogens in terms of "optimum harmfulness."

A cold virus's best strategy, for example, is to keep you awake coughing so your immune system is weak, make you sneeze and cough and have a runny nose so you spread germs, etc. But it shouldn't kill you, especially not before you pass it on. I've heard (did I read it in Guns, Germs and Steel?) that syphillis used to be more deadly, but that it got milder as an adaptive strategy.

Likewise, computer viruses probably have a pain threshold they shouldn't pass. If they can do their masters' bidding without hacking you off so bad that you format the computer, they'll be more successful.

Possibly unwarranted conclusion: computer viruses are now widespread precisely because they're Not That Bad.

So, are they worse than antivirus software? A lot of non-geeks may be asking themselves that question today. "Dang, we got a virus one time, but it didn't keep the computer from BOOTing!"

McAfee has just demonstrated a computer autoimmune disease.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#40

Post by tumblen »

Crazy to think about the consequences of a mistake like this. This was sent by a friend to an email list I'm on:

"Well, consider this community hospital fubared.

IT dudes running around pulling out their hair. If it wasn't affecting patient care it would be a humorous scene-but I can't check xray's, or labs or anything. Took out a horrendously bloody gallbladder this morning, and I can't tell (labwise) if she's still bleeding...not good."

Post reply on HN