DAT 595 – Faulty McAfee Anti-virus update disables computers

Thursday, April 22nd, 2010

A recent automated update to McAfee Anti-virus software caused the software to mistaken detect a key Windows system program as malicious and move it out of its proper location to a McAfee anti-virus quarantine. Due to the critical nature of the quarantined system program, ‘svchost.com’, affected computers failed to start correctly and were sent into a rebooting loop.

According to Microsoft, the affected file ‘is a generic host process name for services that run from dynamic-link libraries’.

McAfee responded to the problem by withdrawing the definition update and later releasing a clean one. The security giant also published advice on how to manually fix affected computers. The influx of interested parties trying to look up this advice through McAfee’s forum caused the site to become unavailable for a short time on Wednesday evening.

Source: The Register

McAfee had the following to say on the matter.

McAfee is aware that a number of customers have incurred a false positive error due to this release. Corporations who kept a feature called “Scan Processes on Enable” in McAfee VirusScan Enterprise disabled, as it is by default, were not affected.
Our initial investigation indicates that the error can result in moderate to significant issues on systems running Windows XP Service Pack 3.

The faulty update was quickly removed from all McAfee download servers, preventing any further impact on customers. We are not aware of significant impact on consumers.

We recommend the use of ESET Anti-virus products including NOD32 Anti-virus and the Smart Security Suite. If you are interested in a secure, reliable anti-virus and computer security solution for you business, please feel free to contact us for more information.

Share and Enjoy:
  • Print
  • Digg
  • Slashdot
  • Twitter
  • del.icio.us
  • Google Bookmarks
  • StumbleUpon
  • Technorati
  • email
  • Facebook
  • Reddit

Anti Virus Removal and Program Recomendations

Thursday, September 24th, 2009

With the Internet constantly being flooded by hundreds of new and more vicious viruses daily it’s never been a more important time to be well protected. It’s quite difficult to fully explain what a virus is as there are so many variations, we’ve know virus’ to be as timid as changing your desktop background to some rather unsavoury pictures to the more severe end of viruses which can launch on a particular date or time to transfer complete control of systems and networks to a single remote user, this could be to soak up all your internet speed or simply to steal important documents, log in details or secure site information such as bank details. These viruses are rare but they do happen, identity theft is becoming a very real problem.

So which Anti-Virus program should you choose? There are so many on the market and everyone has their own opinion as to their favourite. Well we’ve found a little known Anti-Virus package called NOD32, a nifty little package that will not constantly pop up asking you a hundred different questions about program access it also doesn’t slow your system to a crawl as some Anti-Virus packages can. It will occasionally pop up if there is something attempting to penetrate your PC but other than that it’s very much a stealthy program. Don’t take our word for it though you can try a 30 day free trial from here:  http://www.eset.com/products/nod32.php

Sadly no Anti-Virus package is 100 percent full proof, occasionally one may slip under the radar so to speak, so what next? If your Anti-Virus fails to remove or quarantine a virus the last thing you want is to have a rogue virus on your system doing heavens knows what so what we’re aiming to do is assist you in removing the tricky ones.

Again I feel that everyone has their own way of dealing with things but hopefully we’ll give you enough of an idea what you can do in this situation. Firstly you should fully update the Anti-Virus package you are using in the hope that the latest definitions file (the file that contains a catalogue of different virus names) contains removal details, do this until the Anti-Virus package your using reports that it is fully up to date then run a full scan. A full scan of your system can take quite a while so it’s best to do it at the end of the day or if you have to leave to office for a couple of hours. If the update still fails to remove the offending virus then more steps need to be taken, next I would find the “System Restore” option.

***CAUTION****

More and more PCs have built in destructive recovery programs where a small portion of the hard-drive is reserved for the operating system (2000, XP, Vista etc) and can be accessed via the start menu, PLEASE MAKE SURE YOU USE THE MICROSOFT WINDOWS SYSTEM RECOVERY AND NOT THE MANUFACTURER’S VERSION AS THIS CAN AND WILL FORMAT YOUR SYSTEM. When you’ve located this tick the box that reads ”Turn Off System Restore” as this is a well know place for viruses to attach themselves to. Now you should restart your PC and continually tap “F8” as the system is booting (this means start pressing “F8” as soon as the system starts to power on) if done correctly you will see a menu listing various different options, at the top of which is an option called “Safe Mode” this is a way of loading your operating system with absolutely nothing running in the background so don’t panic when it finally loads as it will look VERY basic. In “Safe Mode” most of the drivers will not be initialized. The next step is to re-run your Anti-Virus package because in this mode it may find the rogue virus that you cannot remove.

If the above steps still fail to remove the virus then there is one last thing to try, write down the name of the virus and then open your internet homepage, or whichever search engine you favour, and type in the name of the virus followed by “Removal Instructions” at this stage if it is a know virus there will be specific programs and or deletion steps advised to be taken, this may involve additional downloads or deletion of certain files in the registry. I cannot stress enough at this point if you are at this stage and you don’t feel confident poking around in the registry of your PC it’s time to give Rapid Web a call because if you delete the wrong items in the registry this could lead to loss of data or worse still it could cause your PC to stop working altogether.

So what if it’s not a virus it’s actually Spyware? Well you can follow the same steps as above the only real difference is the software you use to remove this, we can recommend 2 products for this, again personal choice but very effective, one of which is called Spybot: Search And Destroy – free version available here: http://www.safer-networking.org/en/spybotsd/index.html and the other is Adaware 2007 by Lavasoft which you can get from here: http://www.lavasoftusa.com/products/ad_aware_free.php again free version. As before just make sure both programs are up to date before using them as these can also take some time to complete.

Share and Enjoy:
  • Print
  • Digg
  • Slashdot
  • Twitter
  • del.icio.us
  • Google Bookmarks
  • StumbleUpon
  • Technorati
  • email
  • Facebook
  • Reddit

ESet Anti-virus software we like

Friday, August 21st, 2009

eset anti virusSo us techies here at Rapid Web are always kicking around fresh ideas on a daily basis, usually trying to find new and more interesting ways to push hardware to the max and some days were just puzzled as to how you grow seedless grapes but when we have a good idea the general feeling is to push it as far as we can. Like these guys ESet they’re a company that makes one of the best anti-virus solutions on the market today, in our opinion, it’s one of those quiet little invisible programs that you forget you’ve installed until you get a dialog box in the corner advising you that the funny movie clip your downloading where a little cute cat falls of the back of the sofa is actually a Win32 variant of a particularly nasty virus! Not only does it let you know but it then proceeds to just quarantine it and BINGO! You haven’t done a thing and yet your PC is safe! Perfect!

A lot of anti-virus solutions on the market will constantly myther you and I mean constantly would you like to update now? There’s a virus on your PC what should I do? Your anti-virus will run out in 4 months click here to renew… blah blah blah we’ve all been there right? Surely all anybody wants from an Anti-virus package is software that can update itself, doesn’t need 30 minutes of configuration, 2 hours of updates and then lets the virus on the PC and can’t remove it! What’s the point in paying £50 for that?! May as well leave the PC alone and take the missus out…

We have been an  ESet partner now for a couple of years so we can give you this great antivirus software at a very good price - even cheaper than going direct!  so if you need some piece of mind then give us a call and we can have you up and running in minutes.  If your not sure an would like to try it out first well you can download a free trial version from ESet or we can provide a copy too.

Good times,

Clay

Share and Enjoy:
  • Print
  • Digg
  • Slashdot
  • Twitter
  • del.icio.us
  • Google Bookmarks
  • StumbleUpon
  • Technorati
  • email
  • Facebook
  • Reddit