Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

McAfee quarantines svchost.exe on millions of WinXP machines worldwide

andreyf.tumblr.com

Post reply on HN
Print view View original

71–80 of 113 posts

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#71

Post by cookiecaper »

billybob wrote: post #47
tumblen wrote: post #40

Crazy to think about the consequences of a mistake like this. This was sent by a friend to an email list I'm on: "Well, consider this community hospital fubared. IT dudes running around pulling out their hair. If it wasn't affecting patient care it would be a humorous scene-but I can't check xray's, or labs or anything. Took out a horrendously bloody gallbladder this morning, and I can't tell (labwise) if she's still…

Wow. Kinda makes me wonder if we should be using general-purpose computers for so many things. The anti-virus is kind of a major single point of failure for machines that need to do just a few specific things.

I don't think we need to move to special machines, we just need to move to sensibility in choices. Why do these need to be running Windows? Even if they're running Windows, why do they need an antivirus? Are you letting people on attachments from their email or browse the internet on the same box that you're using to read X-rays and other medical imagery? Kind of weird to do that, right?

I need to think about how to exploit this to promote the installation of *nix-based systems and get people to hire my company to do it.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#72

Post by kentosi »

thaumaturgy wrote: post #46

I don't have time to counter all the misinformation here. Just a couple quick points: - McAfee has been crap for a long time now; they're not much better than Norton's products from the last few years. - Corporate networks are running McAfee because McAfee (and TrendMicro, and other garbage a/v vendors) provide incentives to VARs, consultants, resellers, etc. - However, this is a far cry from "all antivirus is bad".…

"- There are plenty of good products available, some of them are free, ..."

Care to list some please? I don't use Windows, but I'm sick of my dad's PC being infected by the "Windows Security" scam application every 4 months. Not to mention the set of other viruses I find when trying to clean it up...

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#73

Post by kentosi »

msbarnett wrote: post #61
smutticus wrote: post #49

Earlier quoted context omitted.

The last computer virus I got was the stoned virus on a DOS 6.2 machines sometime around 1989-90. And I never run anti-virus software. At home I have Windows, OS X and Linux boxen and not in 20 years have I had a computer virus. It's really all about usage patterns more than anything else.

If you haven't run av in 20 years, one wonders what you base the claim of not having had a virus in 20 years on.

The comment probably should've been rephrased as "i haven't been hampered by any virus in 20 years".

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#74

Post by jbm »

proee wrote: post #54
doki_pen wrote: post #52

Earlier quoted context omitted.

First off, I don't claim to be an IT person or know what normal users need to be safe. I can only speak to my personal experience as a programmer. I haven't had a virus in 14 years. I haven't ever run anti-virus software. I have a good feel for all the systems that I use. A little paranoia goes a long way. Not to say that I couldn't be targeted. I'm sure a skilled cracker could break my boxen. But I doubt any antivir…

"I haven't had a virus in 14 years. I haven't ever run anti-virus software." Then I'd say you probably have a virus ;-)

Actually I was the same (while I was running a Windows box). I used to work for an anti-malware company too, and my experiences there pretty much agrees what everyone says about Norton / etc...

I don't open attachments from strangers, I don't have warez on my computer, and I call / confirm when I get a word doc. (It doesn't matter because I do the conversion on googledocs anyway).

I know not everyone is fortunate enough to do all of that, but it is entirely possible to avoid viruses if one really wants to.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#75

Post by niels_olson »

cookiecaper wrote: post #71
billybob wrote: post #47

Earlier quoted context omitted.

Wow. Kinda makes me wonder if we should be using general-purpose computers for so many things. The anti-virus is kind of a major single point of failure for machines that need to do just a few specific things.

I don't think we need to move to special machines, we just need to move to sensibility in choices. Why do these need to be running Windows? Even if they're running Windows, why do they need an antivirus? Are you letting people on attachments from their email or browse the internet on the same box that you're using to read X-rays and other medical imagery? Kind of weird to do that, right? I need to think about how to…

Doc here: do you run a subversion client or an IDE on the same machine you check email or browse the web with? kind of weird to do that, right?

I'm all for nix-based systems. Please, oh please, convince these people to go to nix and web app (that aren't slaved to IE: eg, AHLTA, or Fuji's Synapse imaging software). I will give you their numbers.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#76

Post by joezydeco »

billybob wrote: post #47
tumblen wrote: post #40

Crazy to think about the consequences of a mistake like this. This was sent by a friend to an email list I'm on: "Well, consider this community hospital fubared. IT dudes running around pulling out their hair. If it wasn't affecting patient care it would be a humorous scene-but I can't check xray's, or labs or anything. Took out a horrendously bloody gallbladder this morning, and I can't tell (labwise) if she's still…

Wow. Kinda makes me wonder if we should be using general-purpose computers for so many things. The anti-virus is kind of a major single point of failure for machines that need to do just a few specific things.

It'll all move to thin clients and the cloud. Just watch.

Not saying it's better, and in fact it'll be worse. The net goes down way more than the AntiVirus gets a bogus config file. But you'll see cash-strapped facilities get sold on the idea of cheaper clients on-site and a large server with a juicy maintenance package behind it.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#78

Post by cookiecaper »

niels_olson wrote: post #75
cookiecaper wrote: post #71

Earlier quoted context omitted.

I don't think we need to move to special machines, we just need to move to sensibility in choices. Why do these need to be running Windows? Even if they're running Windows, why do they need an antivirus? Are you letting people on attachments from their email or browse the internet on the same box that you're using to read X-rays and other medical imagery? Kind of weird to do that, right? I need to think about how to…

Doc here: do you run a subversion client or an IDE on the same machine you check email or browse the web with? kind of weird to do that, right? I'm all for nix-based systems. Please, oh please, convince these people to go to nix and web app (that aren't slaved to IE: eg, AHLTA, or Fuji's Synapse imaging software). I will give you their numbers.

I actually freelance with a group that is making a web app for viewing medical imagery. Has a Flex-based frontend, though.

I guess I don't understand the use case -- I had assumed that the computers needed to tell if a patient was bleeding or not were connected to a machine that did some kind of image-taking or internal measurement, and that that machine was the stationary "is patient bleeding machine" computer. Do doctors generally perform analyses like that one on personal computers or normal workstations? I guess I just got a false impression from medical dramas or something.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#79

Post by sokoloff »

maukdaddy wrote: post #48
RevRal wrote: post #22

Earlier quoted context omitted.

I mean McAfee in lieu of a less expensive perfume, like Avast. I'm assuming Avast is less expensive.... Avast is better, though. (And is it just me or is HN freaking out right now?)

The only problem with Avast is enterprise management. Products like Symantec and McAfee suck, but at least provide options for managing 100k+ deployments.

Have a look at Sophos (http://www.sophos.com/).

It was the only one I found in my testing to not destroy Windows filesystem performance when real-time scanning was enabled and to have no discernable impact when real-time scanning was disabled. (Symantec, McAfee, AVG and Avast all hurt disk performance quite a bit, EVEN when disabled, merely by being installed. F-secure was the only other I found to not harm disk performance when installed but inactive.)

Sophos also has a decent enterprise management console. No connection, other than as a customer.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#80

Post by noonespecial »

niels_olson wrote: post #75
cookiecaper wrote: post #71

Earlier quoted context omitted.

I don't think we need to move to special machines, we just need to move to sensibility in choices. Why do these need to be running Windows? Even if they're running Windows, why do they need an antivirus? Are you letting people on attachments from their email or browse the internet on the same box that you're using to read X-rays and other medical imagery? Kind of weird to do that, right? I need to think about how to…

Doc here: do you run a subversion client or an IDE on the same machine you check email or browse the web with? kind of weird to do that, right? I'm all for nix-based systems. Please, oh please, convince these people to go to nix and web app (that aren't slaved to IE: eg, AHLTA, or Fuji's Synapse imaging software). I will give you their numbers.

Absolutely not. I use a virtual instance of windows for that stuff. I'd never do web browsing like activities (or much network connectivity at all) on a machine that was about to compile a binary that might be duplicated thousands of times to thousands of places.

The Parallels windows pc on my mac was hit by this very problem. I had to restore to a 3 day old snapshot just to get it running again. I feel bad for those who were running windows bare-metal who can't just press a button and go back.

Post reply on HN