Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

McAfee quarantines svchost.exe on millions of WinXP machines worldwide

andreyf.tumblr.com

Post reply on HN
Print view View original

61–70 of 113 posts

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#61

Post by msbarnett »

smutticus wrote: post #49
thaumaturgy wrote: post #44

Earlier quoted context omitted.

Well, first off, I have bad news for you: the more recent rootkits we've been seeing are doing exactly this. They are very quiet, very sneaky, very hard to remove, and they just love it when you purchase items online. As far as whether viruses or antivirus software are worse to deal with -- well, I have three systems in the shop so far today for virus infections that were so bad that it rendered the computer unusable…

The last computer virus I got was the stoned virus on a DOS 6.2 machines sometime around 1989-90. And I never run anti-virus software. At home I have Windows, OS X and Linux boxen and not in 20 years have I had a computer virus. It's really all about usage patterns more than anything else.

If you haven't run av in 20 years, one wonders what you base the claim of not having had a virus in 20 years on.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#62

Post by Jd »

Anyone think that this might be an ingenious hack by a "virus" writer? Instead of targeting the computer, target the manufacturer that makes the code that is supposedly protecting the computer. If so, I'll bet all it took was one line in one list of malicious files.

No one may have thought to protect those back doors...

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#63

Post by mynameishere »

dsplittgerber wrote: post #3

If I were a trader, I'd short McAfee right now. This probably means lots of settlements. EDIT: This could actually be a profitable venture. Somewith with at least basic HN-type knowledge and a daytrading account could make serious money. Finance professionals most probably have no idea how important specific IT news are during the day. One should be able to trade ahead of consensus pretty easily.

Finance professionals most probably have no idea how important specific [fill-in-the-blank] news

Yes, they do. There are lots of hedge funds that do nothing but analyze news feeds and trade on them all day long.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#64

Post by awad »

spamizbad wrote: post #24
andreyf wrote: post #17

Earlier quoted context omitted.

Unless the settlements are enormous, the market never will. Or if they lose big clients. My wife tells me all computers in PWC's NYC office are out.

Shame on PWC for not upgrading to Vista or Windows 7. A firm that large should have more foresight in IT planning.

I don't know if you're serious or not, but the largest companies are also some of the slowest moving. We had Windows 2000 machines at Merrill Lynch, running Office 2000.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#65

Post by pbhjpbhj »

cynicalkane wrote: post #11
dsplittgerber wrote: post #3

If I were a trader, I'd short McAfee right now. This probably means lots of settlements. EDIT: This could actually be a profitable venture. Somewith with at least basic HN-type knowledge and a daytrading account could make serious money. Finance professionals most probably have no idea how important specific IT news are during the day. One should be able to trade ahead of consensus pretty easily.

You'd be making a trade based on how the market responds to news. Just because you care about this news doesn't mean the market will. Unless the settlements are enormous, the market never will.

I looked at this sort of thing before for tech sector - MSFT when the European anti-trust stuff came off, etc. - but it never seems to make a difference for some reason.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#67

Post by chrisbolt »

smutticus wrote: post #49
thaumaturgy wrote: post #44

Earlier quoted context omitted.

Well, first off, I have bad news for you: the more recent rootkits we've been seeing are doing exactly this. They are very quiet, very sneaky, very hard to remove, and they just love it when you purchase items online. As far as whether viruses or antivirus software are worse to deal with -- well, I have three systems in the shop so far today for virus infections that were so bad that it rendered the computer unusable…

The last computer virus I got was the stoned virus on a DOS 6.2 machines sometime around 1989-90. And I never run anti-virus software. At home I have Windows, OS X and Linux boxen and not in 20 years have I had a computer virus. It's really all about usage patterns more than anything else.

I never ran anti-virus software, until I was at a friend's house and added his shared printer and Windows helpfully downloaded the virus-infected drivers from his PC...

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#68

Post by adamsmith »

jxcole wrote: post #58
Daniel_Newby wrote: post #57

Why does AV software not have a secure checksum-based whitelist? It is not as if Microsoft keeps the important system files secret.

For that matter, why didn't they test this on at least one machine before releasing it? Is it not standard to have a release process that includes testing?

Not to mention incremental roll outs, which would have caught this problem before it hit every win xp machine.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#69

Post by wglb »

billybob wrote: post #39
mrcharles wrote: post #4

Just another nail in the coffin of the usefulness of AV systems. And good riddance. My work computer actually has McAfee on it, which I've disabled through the registry. Don't like how slow it makes my computer. Education, people! It's better than buying useless feel-good software.

I think it's interesting to consider computer viruses and biological pathogens in terms of "optimum harmfulness." A cold virus's best strategy, for example, is to keep you awake coughing so your immune system is weak, make you sneeze and cough and have a runny nose so you spread germs, etc. But it shouldn't kill you, especially not before you pass it on. I've heard (did I read it in Guns, Germs and Steel?) that syphi…

To computer viruses and biological pathogens, add virus scanners--that model holds. For example, if this incident causes sufficient negative publicity for McAfee, then perhaps it could disappear.

Does anyone recall the Michelangelo virus? One of the virus detection programs special release for that wiped the boot sector of every drive it was installed on. I think it is fair to say that in that case, the anti caused more monetary loss that the virus.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#70

Post by orborde »

mrcharles wrote: post #29
daten wrote: post #23

Earlier quoted context omitted.

With fake SSL certificates signed by "real" CAs, cross-site scripting and other advances in phishing attacks, just educating users may not be as effective as it used to be. Malware is quickly becoming advanced enough that even trained technical users may be fooled. Many attacks don't require user interaction. AV products may be slow to respond and signature matching won't catch everything, but if it catches half of w…

I wonder if the value of the total things stopped by McAfee, in all its time, outweighs the purported damage of this incident. I'm thinking no.

On what basis do you say no? This is a single large, noticeable incident, but that doesn't mean that it outweighs millions of tiny ones prevented.
Post reply on HN