OIT Briefs Campus on Antivirus Update Mishap

*********************************
There is now a CONTENT FREEZE for Mercury while we switch to a new platform. It began on Friday, March 10 at 6pm and will end on Wednesday, March 15 at noon. No new content can be created during this time, but all material in the system as of the beginning of the freeze will be migrated to the new platform, including users and groups. Functionally the new site is identical to the old one. webteam@gatech.edu
*********************************

Contact

Richard Biever
OIT-Information Security
404-894-6318 

Sidebar Content
No sidebar content submitted.
Summaries

Summary Sentence:

Machines running Windows XP Pro, Service Pack 3 with McAfee Antivirus may have received a software update rendering them unusable

Full Summary:

Yesterday, the Office of Information Technology (OIT) learned that an update to campus machines running Windows XP Pro, Service Pack 3 with McAfee Antivirus installed was causing machines to reboot and enter an unusable state. 

Yesterday at 9:15 a.m., the Office of Information Technology (OIT) learned that an update to campus machines running Windows XP Pro, Service Pack 3 with McAfee Antivirus installed was causing machines to reboot and enter an unusable state. The issue was caused by a virus definition update (also called a DAT file) that quarantined a critical Windows system file by mistake. OIT immediately contacted McAfee and began working on a solution. OIT rolled back to a good DAT file at 10 a.m. and provided instructions to the technical community on how to clean up affected machines at noon. The DAT file that caused the issue was removed from Georgia Tech's McAfee servers (also known as ePO servers).

At last count, more than 500 machines that are centrally managed by the Georgia Tech McAfee servers were affected and repaired. However, a large segment of the population, including students, is running stand-alone versions of McAfee that are also affected. The Technology Support Center and Residential Housing Technical Support staff are working with students to recover from this issue.

This incident was not isolated to Georgia Tech. The bad DAT file was pushed out from McAfee to all McAfee customers worldwide, resulting in a large-scale remediation effort for all McAfee customers, not just Georgia Tech.

OIT would like to thank the campus IT technology community for their quick work and help to get the issue resolved and assist users with affected computers. Without their help, the incident would have been much worse.

OIT will continue to work with McAfee and the campus IT community to resolve any lingering problems arising from this issue and will be taking steps to help reduce the chances of such an incident occurring at Georgia Tech in the future. In the meantime, if your computer is exhibiting any of the symptoms described above, please contact your unit’s technical staff or the campus Technology Support Center at 404-894-7173.

To read McAfee’s response, visit:
http://siblog.mcafee.com/support/mcafee-response-on-current-false-positive-issue/

Related Links

Additional Information

Groups

News Briefs

Categories
Institute and Campus, Student and Faculty, Student Research
Related Core Research Areas
No core research areas were selected.
Newsroom Topics
No newsroom topics were selected.
Keywords
antivirus, DAT, McAfee, oit, software support
Status
  • Created By: Michael Hagearty
  • Workflow Status: Published
  • Created On: Apr 22, 2010 - 10:25am
  • Last Updated: Oct 7, 2016 - 11:05pm