Samenuk's McAfee Mistakenly Flags Microsoft Office Components

Forbes ^ | March 13, 2006 | Chris Noon

[Republican Wildcat]

London - Collateral damage? Virus slayer McAfee admitted on Friday that an error in its definition file meant its security tools had flagged a few harmless good eggs along with its usual horde of saboteurs as it policed the cyber-streets.

Antivirus software detected Microsoft Office components--Excel.exe and Graph.exe--and Adobe Systems' (nasdaq: ADBE - news - people ) AdobeUpdateManager.exe--an application installed alongside Adobe products that deals with software updates, as a virus called W95/CTX. According to a media report, W95/CTX is an obscure Windows 95 virus that McAfee first identified in 2004.

A malicious flag was even applied to updaterui.exe, McAfee's (nyse: MFE - news - people ) own update program. "Files that we did identify would probably be deleted or quarantined, depending on your settings," the director of operations at McAfee's Avert labs, was quoted as saying in a media report. When a file gets nabbed for quarantine, it's renamed and moved to a different folder. McAfee has pushed out a faulty virus-definitions update and a repaired emergency-definition file.

Batches of so-called "false positives" like these are apparently quite common among the anti-virus vendors. George Samenuk's McAfee normally has to do an emergency release of a virus definition file once every so often because of a false positive issue, though the most recent mistake was slightly graver than usual since the company flagged Excel. Microsoft (nasdaq: MSFT - news - people ) is rolling out its own security service, to compete with McAfee and Symantec (nasdaq: SYMC - news - people ).

McAfee's solution for customers affected by the overzealous clean-up? "Users who have moved detected files to quarantine should restore them to their original location. Windows users who have had files deleted should restore files from backup or use System Restore."

[Republican Wildcat]

Anybody else get this scare when they scanned Friday afternoon? Thankfully, I had for some reason forgot to remove a software CD-rom from my drive and it was scanned as well while I was away and showed that it was also infected by the virus - it was a drive that could not write to CDs and a CD that was not writeable, so I knew the definitions file must have been messed up. Otherwise, I would have unnecessarily caused myself a lot of annoyance in getting those files back.

[darkwing104]

Good thing they haven't made an XP X64 version of thier Antivirus software.

[kellynla]

BTTT

[M-cubed]

Jeez!...I don't know a thing about this stuff..but my Norton anti-virus was tampered with...The same thing?

[fhlh]

FREEavg works great and is free for home users.

IMHO, norton and mcafee are virus' in their own right.

[Steel and Fire and Stone]

The last time I purchased McAfee was about 3-4 years ago, when they first came out with their WIN/XP compatible firewall. I had enormous problems, and it eventually locked out all internet addresses, even with the firewall disabled, even with the software uninstalled! The only way I figured out the problem was that I eventually created a second bootable partition, reloaded WIN/XP , and the next thing I reloaded was firewall and virus protection. As soon as I reloaded McAfee, the problem reappeared. I'm a computer professional, but the only way I could correct the problem was to trash the primary partition and reload the operating system and of course, every last bit of software installed.

After that experience, NEVER AGAIN will I install McAfee. I've had good luck with Norton, though it can be clugy, and currently have Computer Associates antivirus products (plus one AVG) on our home PC's. I thing I'm going to stick with CA's EZAntivirus - it was pretty easy to install and use, and seems to catch all of the bad actors. (Plus I just picked up a 3-user license on Ebay for about $10.00.)

SFS

[Republican Wildcat]

Wow...

Well, anyway, this was the first issue I ever had with McAfee. I've used them for about 10 years now and never had any major problems (and thankfully I had that CD in the drive and didn't have a problem this time around).