Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

McAfee quarantines svchost.exe on millions of WinXP machines worldwide

andreyf.tumblr.com

Post reply on HN
Print view View original

101–110 of 113 posts

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#101

Post by houseabsolute »

billybob wrote: post #47
tumblen wrote: post #40

Crazy to think about the consequences of a mistake like this. This was sent by a friend to an email list I'm on: "Well, consider this community hospital fubared. IT dudes running around pulling out their hair. If it wasn't affecting patient care it would be a humorous scene-but I can't check xray's, or labs or anything. Took out a horrendously bloody gallbladder this morning, and I can't tell (labwise) if she's still…

Wow. Kinda makes me wonder if we should be using general-purpose computers for so many things. The anti-virus is kind of a major single point of failure for machines that need to do just a few specific things.

A better solution is to disable all kinds of automatic updating on computers you manage and canary changes on just a couple of machines first.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#102

Post by dustingetz »

mrcharles wrote: post #4

Just another nail in the coffin of the usefulness of AV systems. And good riddance. My work computer actually has McAfee on it, which I've disabled through the registry. Don't like how slow it makes my computer. Education, people! It's better than buying useless feel-good software.

not all malware requires user permission to execute -- modern web malware uses a browser exploit to run itself, you and i probably wouldn't realize it.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#103

Post by jonknee »

cookiecaper wrote: post #78
niels_olson wrote: post #75

Earlier quoted context omitted.

Doc here: do you run a subversion client or an IDE on the same machine you check email or browse the web with? kind of weird to do that, right? I'm all for nix-based systems. Please, oh please, convince these people to go to nix and web app (that aren't slaved to IE: eg, AHLTA, or Fuji's Synapse imaging software). I will give you their numbers.

I actually freelance with a group that is making a web app for viewing medical imagery. Has a Flex-based frontend, though. I guess I don't understand the use case -- I had assumed that the computers needed to tell if a patient was bleeding or not were connected to a machine that did some kind of image-taking or internal measurement, and that that machine was the stationary "is patient bleeding machine" computer. Do d…

What if the doctor reading the scan is in another city/country? That's becoming increasingly more common.

Though on the AV front it doesn't make sense to have all of your organization's computers running critical software to update at the same time (no matter what software, it just happened to be the anti-virus this time).

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#104

Post by itgoon »

doki_pen wrote: post #52
thaumaturgy wrote: post #46

I don't have time to counter all the misinformation here. Just a couple quick points: - McAfee has been crap for a long time now; they're not much better than Norton's products from the last few years. - Corporate networks are running McAfee because McAfee (and TrendMicro, and other garbage a/v vendors) provide incentives to VARs, consultants, resellers, etc. - However, this is a far cry from "all antivirus is bad".…

First off, I don't claim to be an IT person or know what normal users need to be safe. I can only speak to my personal experience as a programmer. I haven't had a virus in 14 years. I haven't ever run anti-virus software. I have a good feel for all the systems that I use. A little paranoia goes a long way. Not to say that I couldn't be targeted. I'm sure a skilled cracker could break my boxen. But I doubt any antivir…

> I haven't had a virus in 14 years.

That you know of.

I can say the same thing, but I always put in that little caveat at the end. Same for being hacked. I've looked for evidence, and never found any reason to believe otherwise.

I've done too many cleanups for people, for whom I have the upmost respect, who said similar things for me lose my humility on that score.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#105

Post by dsplittgerber »

awa wrote: post #19
dsplittgerber wrote: post #16

Earlier quoted context omitted.

You have a point. Their market cap still dropped by 50 million in the last 40 minutes - whilst not being enormous, it's still noteworthy so far.

The stock is just following S&P 500 and not dropping on its own http://www.google.com/finance?chdnp=1&chdd=1&chds=1&...

S&P 500 down 1.05% today, half an hour after opening bell, MFE down 3.6%. So it would have been a nice short after all.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#106

Post by TwoSheds »

Periodic wrote: post #41
billybob wrote: post #39

Earlier quoted context omitted.

I think it's interesting to consider computer viruses and biological pathogens in terms of "optimum harmfulness." A cold virus's best strategy, for example, is to keep you awake coughing so your immune system is weak, make you sneeze and cough and have a runny nose so you spread germs, etc. But it shouldn't kill you, especially not before you pass it on. I've heard (did I read it in Guns, Germs and Steel?) that syphi…

Viruses used to be largely statements and annoyances, the sort of thing a rebellious teenager would pursue as a form of computer vandalism. Then people realized there was money in botnets and password stealing. The goal of those viruses is to get onto your computer and stay there as long as possible. If you notice it, you'll remove it, so it is in their best interest to avoid being noticed. Unfortunately, a lot of th…

Unfortunately?

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#107

Post by dsplittgerber »

mynameishere wrote: post #63
dsplittgerber wrote: post #3

If I were a trader, I'd short McAfee right now. This probably means lots of settlements. EDIT: This could actually be a profitable venture. Somewith with at least basic HN-type knowledge and a daytrading account could make serious money. Finance professionals most probably have no idea how important specific IT news are during the day. One should be able to trade ahead of consensus pretty easily.

Finance professionals most probably have no idea how important specific [fill-in-the-blank] news Yes, they do. There are lots of hedge funds that do nothing but analyze news feeds and trade on them all day long.

True, in general principle. In this case, I disagree. MFE was down similar to S&P 500 yesterday. After opening today, not so anymore (-3.6% vs -1%). So market participants clearly did not incorporate the news into their immediate trading yesterday.

Also, whilst market participants watch news feeds, there is a clear difference between following news and trading the tape vs having an actual clue as to what a specific news item means in hard money for a company.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#108

Post by Khaki »

jbm wrote: post #74
proee wrote: post #54

Earlier quoted context omitted.

"I haven't had a virus in 14 years. I haven't ever run anti-virus software." Then I'd say you probably have a virus ;-)

Actually I was the same (while I was running a Windows box). I used to work for an anti-malware company too, and my experiences there pretty much agrees what everyone says about Norton / etc... I don't open attachments from strangers, I don't have warez on my computer, and I call / confirm when I get a word doc. (It doesn't matter because I do the conversion on googledocs anyway). I know not everyone is fortunate eno…

Not anymore. If you receive a targeted attack or a 0-day attack vector through a firefox, pdf or even libpng vulnerability, the only real way you can be safe is to unplug your computer from the internet.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#109

Post by watmough »

furyg3 wrote: post #51
Periodic wrote: post #42

Earlier quoted context omitted.

For the IT staff, the fact that your computer slows down is an externality; it is not their problem. If the anti-virus can catch a few viruses and doesn't result in many help-desk tickets, then it makes their lives easier. Cleaning up a virus is a tedious task, as even a simple re-imaging can take a while, and that's if you can use a standard image. They also don't know how smart their users are. Some of them are gre…

> Their current goal is usually just to make sure it runs at all. Indeed. I'm the lead of the "IT Staff" at a small non-profit (~70 users) running mostly on second-hand desktops. Two-thirds of our staff is unpaid, usually interns who are here a few days a week for 3 months, and then they're gone and someone new takes their place. Training proper computer behavior is hard. So... we run A/V (not McAffee), because we ha…

There are a couple of ways to address the virus problem besides installing anti-virus on Windows.

Here's a few things I'd consider if I wanted to run an office with minimal computer support:

  - run the LTS Ubuntu instead of Windows
  - maybe run OS X, on Mac Minis if buying new hardware
  - install one Windows terminal server for critical Windows-only software
  - lock down firewall to permit only whitelisted web-sites
  - run locally hosted (I believe this is possible) Google Docs as office software
Windows virus problems, people surfing Facebook, porn, you-tube, Twitter etc., will suck away time in an office if you don't get some kind of a handle on it. I hate offices where stuff is super locked-down, but put in charge, I'd want to screw things down pretty tight.

Obviously developers, salespeople might be somewhat of an exception... it's a hard call to make.

Re: McAfee quarantines svchost.exe on millions of WinXP machines worldwide

#110

Post by eru »

smhinsey wrote: post #88
chbarts wrote: post #55

Earlier quoted context omitted.

Best Practices, n.: Making the same mistakes everyone else does. However, what are the odds of someone being able to make special-purpose machines to do everything COTS boxes are used for, and making those machines as fast, cheap, and reliable as COTS systems are now? Some things seem obvious (x-ray machines, lab machines) but accounting and record-keeping? Going back to adding machines and purely manual filing is no…

I think virtualization takes you a long way towards the solution to this issue. With Win7 I've gotten into the habit of routinely working on virtual instances using the boot from .vhd feature. This means that if something goes wrong my host is not impacted and I can revert to an earlier version of my .vhd to solve problems like this one. The standard IT "wait and see" policy makes this something that will take awhile…

And if you use a Type-1 hypervisor (i.e. one that runs on the bar metal) you should be even safer.
Post reply on HN