Mcafee dat #5664 triggers false positives on 5100 engine

[pete]

Spotted on El Reg at lunchtime:

McAfee false-positive glitch fells PCs worldwide ? The Register

It _appears_ to just affect machines on mcafee engine 5100 (we're on 53** here) and testing on a spare XP vm* does cause issues if you're on 5100 and use the aforementioned dat file. Nothing happens on 5200 or 5300 when I tested, but I disclaim all responsibilty for anyone acting on the info .

*snapshots are awesome.

[Michael]

I don't use McAfee but this could create big problems for some businesses, especially if BSODs are appearing on workstations and servers. Not quite sure how this'll get fixed, because even if you repaired Windows (which would restore the missing files) McAfee would still remove it when the system's back up

[AngryTechnician]

Last time I dealt with McAfee support I actually found myself having to explain the very concept of a false positive to them. The guy I spoke to insisted that if it was being detected, it must be a virus.

I uninstalled later that day. McAfee posted their alert over the false positive about two hours after that.

[pete]

We get Mcafee paid for by the LEA / top-sliced. It's..... adequate and while there are better products out there, they all suck in their own ways. Going from free > x thousand a year would involve a fair amount of persuading of the SMT.

It's worth noting that the 5100 and the 5200 engine are unsupported by Mcafee, so anyone using them needs a kick up the arse. Not that Mcafee aren't complete numptys for not testing thoroughly - the PR fallout alone would make it worthwhile.

[User3204]

We use Mcafee, because it's fairly cheap, but mostly because it was here when I started...

I hav jus checked a machine with an old version of Mcafee (v 8.0 ) it's running engine 5300 ! so that would mean 5100, is at least two years old.

Anyone still running that.. really.. deserves anything they get...