Whoops. Our Bad.

McAfee released a “faulty update” this morning causing the security program to believe a good file had gone bad. In what the company calls a “False Positive Issue,” the anti-virus software identifies a good windows file, svchost.exe, as the W32/Wecorl.a virus; causing the system to continuously reboot and lose network access.

At the University Hospital in Syracuse, NY 2,500 computers were affected; however the hospital stated that patient care was not compromised. Other public service/safety organizations were also impacted, including the Kentucky State Police, the National Science Foundation, and Illinois State University.

The impact forced several Rhode Island hospitals to stop treatment of non-trauma patients in emergency rooms as well as postpone non-essential surgeries.

McAfee’s Barry McPherson posted on their security blog:

McAfee is aware that a number of customers have incurred a false positive error due to this release. Corporations who kept a feature called “Scan Processes on Enable” in McAfee VirusScan Enterprise disabled, as it is by default, were not affected.

Our initial investigation indicates that the error can result in moderate to significant issues on systems running Windows XP Service Pack 3.

The faulty update was removed from all McAfee download servers within hours, preventing any further impact on customers. We believe that this incident has impacted less than one half of one percent of our enterprise accounts globally and a fraction of that within the consumer base.

For More Information:

• McAfee: McAfee Response To Current False Positive Issue
• ZDNet: Defective McAfee update causes worldwide meltdown of XP PCs
• Syracuse.com: University Hospital computers plagued by anti-virus glitch