Broadband Tech > Security > Security > McAfee/NAI rolls bad pattern

McAfee/NAI rolls bad pattern

Thank you very much for posting this info. I'm glad I decided to check here before allowing McAfee to start deleting or quartineing files.
--
Road to hell paved with unbought stuffed dogs. Hemingway

reply to hurleyp
Just this morning I woke up to find an alleged 37 files infected with the W95/CTX virus. Fortunately, I doubted the report and looked at the Virus Help on McAfee's web site, where it said that 4715 produces FPs and to get 4716.

But I am an experienced user, and work in I.T. so I was reasonably certain that the report was false. How about the 99% of the users who would have just quaranteened the files? That's a BIG "my bad" for McAfee.

reply to hurleyp
At least if you set McAfee to quarantine "infected" files, you can go about restoring them. Not an easy job, but much better than if they were deleted. I use NAV, and after I saw this report I checked my options and sure enough, NAV was set to delete infected files. I've changed that to quarantine just in case NAV starts going false-positive crazy!

Paul
--
"I reject your reality and substitute my own."

reply to hurleyp
Well CRAP! I had 161 files false tagged and quaratined because of this fiasco! Now I've got to go back and restore each one by hand!!!!

reply to hurleyp
Thanks for the heads up. I came home yesterday and found 48 files with W95/CTX. They were all main program files and I almost had a heart attack.

I finally restored them and everything worked fine, until I installed NOD32 My system froze up and wouldn't allow me into the safe mode What a mess that was!
--
Frankly Speaking!

reply to hurleyp
Here is a March 12 follow-up to this incident from SANS:

»isc.sans.org/diary.php?storyid=1184&rss

"Users who have moved detected files to quarantine should restore them to their original location. Windows users who have had files deleted should restore files from backup or use System Restore."

Gee, thanks.

Paul
--
"I reject your reality and substitute my own."

reply to hurleyp
A lot of antivirus companies in an effort to get definitions out first, are compromising on the quality of their definitions. We seen that with NOD32, KAV, now McAfee. I agree that FPs do occur, but I think some needs to keep score on how many times they occur for various companies.

reply to hurleyp
Just got done cleaning up the mess this caused at my workplace.
Good way to start a Monday!

I think we got off pretty easy tho, the 4716 release happened before a lot happened to us, did have some servers affected tho.

-ForeverZero-

reply to hurleyp
McAfee has created a cleanup tool to restore files incorrectly quarantined by the bad DAT update. Follow the link in the 13 Mar update at »vil.nai.com/vil/content/v_138884.htm
--
"I reject your reality and substitute my own."