Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

McAfee quarantines svchost.exe on millions of WinXP machines worldwide

andreyf.tumblr.com

Post reply on HN
Print view View original

41–50 of 113 posts

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#41

Post by Periodic »

billybob wrote: post #39
mrcharles wrote: post #4

Just another nail in the coffin of the usefulness of AV systems. And good riddance. My work computer actually has McAfee on it, which I've disabled through the registry. Don't like how slow it makes my computer. Education, people! It's better than buying useless feel-good software.

I think it's interesting to consider computer viruses and biological pathogens in terms of "optimum harmfulness." A cold virus's best strategy, for example, is to keep you awake coughing so your immune system is weak, make you sneeze and cough and have a runny nose so you spread germs, etc. But it shouldn't kill you, especially not before you pass it on. I've heard (did I read it in Guns, Germs and Steel?) that syphi…

Viruses used to be largely statements and annoyances, the sort of thing a rebellious teenager would pursue as a form of computer vandalism.

Then people realized there was money in botnets and password stealing. The goal of those viruses is to get onto your computer and stay there as long as possible. If you notice it, you'll remove it, so it is in their best interest to avoid being noticed.

Unfortunately, a lot of them are so poorly written they are hard not to notice.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#42

Post by Periodic »

mattmaroon wrote: post #25
jswinghammer wrote: post #8

I don't understand why people install antivirus software on their machines. I read once that their catch rate is something like 20-30% which strikes me as no better than 0% for all the good it does most of their customers. It just seems to slow down computers a lot and yield little benefit other than protection for the IT staff when things go wrong. I could make antivirus software that does nothing and probably make…

You read Hacker News, which means you probably know more about computers than at least 99% of the population, and far more than 98%. Seriously, consider that. Take something you don't know about. For me it's cars. If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right? This is what people are told: Windows is insecure and anyone with a clue c…

For the IT staff, the fact that your computer slows down is an externality; it is not their problem. If the anti-virus can catch a few viruses and doesn't result in many help-desk tickets, then it makes their lives easier. Cleaning up a virus is a tedious task, as even a simple re-imaging can take a while, and that's if you can use a standard image.

They also don't know how smart their users are. Some of them are great, and might read HN, but others will go download any game or smiley pack they can find.

If IT staff were paid based on how smoothly the computers run, they might have a different opinion. Their current goal is usually just to make sure it runs at all.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#43

Post by gorm »

dsplittgerber wrote: post #3

If I were a trader, I'd short McAfee right now. This probably means lots of settlements. EDIT: This could actually be a profitable venture. Somewith with at least basic HN-type knowledge and a daytrading account could make serious money. Finance professionals most probably have no idea how important specific IT news are during the day. One should be able to trade ahead of consensus pretty easily.

This could be the most costly consumer software blunder ever? Imagine all the consultants called in for duty.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#44

Post by thaumaturgy »

billybob wrote: post #39
mrcharles wrote: post #4

Just another nail in the coffin of the usefulness of AV systems. And good riddance. My work computer actually has McAfee on it, which I've disabled through the registry. Don't like how slow it makes my computer. Education, people! It's better than buying useless feel-good software.

I think it's interesting to consider computer viruses and biological pathogens in terms of "optimum harmfulness." A cold virus's best strategy, for example, is to keep you awake coughing so your immune system is weak, make you sneeze and cough and have a runny nose so you spread germs, etc. But it shouldn't kill you, especially not before you pass it on. I've heard (did I read it in Guns, Germs and Steel?) that syphi…

Well, first off, I have bad news for you: the more recent rootkits we've been seeing are doing exactly this. They are very quiet, very sneaky, very hard to remove, and they just love it when you purchase items online.

As far as whether viruses or antivirus software are worse to deal with -- well, I have three systems in the shop so far today for virus infections that were so bad that it rendered the computer unusable. One woman told me she broke down and cried because her brand new laptop got infected yesterday and quit working just before she was supposed to do online college course work.

Running without A/V software is exceptionally stupid at this point, even if you think you're smarter than everyone else.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#45

Post by boredguy8 »

smallblacksun wrote: post #36
kalid wrote: post #30

Earlier quoted context omitted.

The 99.8% includes a known test set for historic viruses from the 80s and 90s. The stuff you really care about are the new things that sweep the web (Blaster, Slammer, Code Red, etc.). AV is inherently reactive, and that .2% you miss is likely the latest stuff.

Old (meaning a year or two) viruses are still around, and can still do a lot of damage. A large part of the reason they don't is because people run virus scanners that catch them, and stop them from spreading.

Well, I mean, patching...

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#46

Post by thaumaturgy »

I don't have time to counter all the misinformation here. Just a couple quick points:

- McAfee has been crap for a long time now; they're not much better than Norton's products from the last few years.

- Corporate networks are running McAfee because McAfee (and TrendMicro, and other garbage a/v vendors) provide incentives to VARs, consultants, resellers, etc.

- However, this is a far cry from "all antivirus is bad". There are plenty of good products available, some of them are free, and they don't have serious negative impacts on system performance. The on-demand catch rating of some of these products exceeds 97% in independent lab testing, which is pretty damn good.

- If you use a company computer, and you have disabled antivirus on your system because you don't like it, you are putting not just your company's computer, but your company's network at risk. In most "serious" companies, this would be grounds for termination, and I don't blame them. I would also like to emphasize that the workstation you use belongs to your employer, not you.

- I don't care how smart you think you are, if you're running Windows, you're at risk. Even current versions of Firefox are vulnerable to remote exploits, and we've been seeing a hell of an uptick recently in website infections. That blog that you've been visiting for years might try to hit your computer with something nasty tomorrow, and you'll never even notice. For that matter, a lot of website administrators don't realize they have a problem for a long time.

- Rootkits are getting very quiet and very sneaky. I think we're starting to see a trend where computers are coming in with a couple of different infections: one is a recent rogue antivirus infection which drives the user to get help, and the other is an older rootkit that's been running quietly in the background for a while.

You guys should know better.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#47

Post by billybob »

tumblen wrote: post #40

Crazy to think about the consequences of a mistake like this. This was sent by a friend to an email list I'm on: "Well, consider this community hospital fubared. IT dudes running around pulling out their hair. If it wasn't affecting patient care it would be a humorous scene-but I can't check xray's, or labs or anything. Took out a horrendously bloody gallbladder this morning, and I can't tell (labwise) if she's still…

Wow. Kinda makes me wonder if we should be using general-purpose computers for so many things. The anti-virus is kind of a major single point of failure for machines that need to do just a few specific things.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#48

Post by maukdaddy »

RevRal wrote: post #22
maukdaddy wrote: post #18

Earlier quoted context omitted.

You are. Despite all of its shortcomings, AV is still pretty effective at blocking crap for non-technical users. Perfect? Of course not. But even a 50% catch rate is better than nothing. At my current job, we see our fair share of 0-day and too-new-to-be-caught-by-AV stuff. However, we also see a great deal of infections from viruses that are at least 1-2 years old. Even stupid AV can catch viruses that old.

I mean McAfee in lieu of a less expensive perfume, like Avast. I'm assuming Avast is less expensive.... Avast is better, though. (And is it just me or is HN freaking out right now?)

The only problem with Avast is enterprise management. Products like Symantec and McAfee suck, but at least provide options for managing 100k+ deployments.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#49

Post by smutticus »

thaumaturgy wrote: post #44
billybob wrote: post #39

Earlier quoted context omitted.

I think it's interesting to consider computer viruses and biological pathogens in terms of "optimum harmfulness." A cold virus's best strategy, for example, is to keep you awake coughing so your immune system is weak, make you sneeze and cough and have a runny nose so you spread germs, etc. But it shouldn't kill you, especially not before you pass it on. I've heard (did I read it in Guns, Germs and Steel?) that syphi…

Well, first off, I have bad news for you: the more recent rootkits we've been seeing are doing exactly this. They are very quiet, very sneaky, very hard to remove, and they just love it when you purchase items online. As far as whether viruses or antivirus software are worse to deal with -- well, I have three systems in the shop so far today for virus infections that were so bad that it rendered the computer unusable…

The last computer virus I got was the stoned virus on a DOS 6.2 machines sometime around 1989-90.

And I never run anti-virus software. At home I have Windows, OS X and Linux boxen and not in 20 years have I had a computer virus.

It's really all about usage patterns more than anything else.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#50

Post by kgermino »

smutticus wrote: post #49
thaumaturgy wrote: post #44

Earlier quoted context omitted.

Well, first off, I have bad news for you: the more recent rootkits we've been seeing are doing exactly this. They are very quiet, very sneaky, very hard to remove, and they just love it when you purchase items online. As far as whether viruses or antivirus software are worse to deal with -- well, I have three systems in the shop so far today for virus infections that were so bad that it rendered the computer unusable…

The last computer virus I got was the stoned virus on a DOS 6.2 machines sometime around 1989-90. And I never run anti-virus software. At home I have Windows, OS X and Linux boxen and not in 20 years have I had a computer virus. It's really all about usage patterns more than anything else.

You don't run AV? I'm going to bet that the last virus you know about was 89-90... Although depending on what you use your computers for your still probably ahead of the rest of us.

EDIT:Fixed some typos

Post reply on HN