Feeds

OK, we get the message, Microsoft: Windows Defender splats 1000s of WinXP, Server 2k3 PCs

Anti-malware update gaffe trashes axed OSes

Top 5 reasons to deploy VMware with Tegile

Microsoft has fixed a snafu with Windows Defender that took down thousands of business PCs and servers running Windows XP and Server 2003.

The software giant responded to sysadmins complaining on TechNet that large numbers of their machines were borked after they’d installed Microsoft’s latest set of antivirus definitions.

Once the dodgy signature update for System Center Endpoint Protection (SCEP) and Forefront Endpoint Protection (FEP) had been installed, it caused PCs and servers to hang at logon until Msmpeng.exe, a core part of Windows Defender, crashed.

The only solution to getting affected machines back up was to uninstall the updated signatures.

One sysadmin took to TechNet to complain of 750 knackered PCs, with another claiming he'd seen 3,500 PCs walloped.

The culprit is a group of antivirus definition updates in SCEP and FEP, released on April 16. The versions most complained about were numbers 1.171.1.0, 171.46.0 and 1.171.39.0.

Redmond told The Reg that applying the latest set of antivirus signatures would rescue affected systems without the need to uninstall the update that caused the problems.

One Reg reader contacted us to say: “Seems like an engine and/or signature update to FEP in combination with a specific setting within FEP crashes FEP, which then knocks out the affected computer from the network.”

A Microsoft spokesperson admitted the company had released an anti-malware engine update that “may have caused interrupted service for customers” using the company’s security products.

The spokesperson said the latest signature update would automatically resolve the issue, implying there’s no need to uninstall the faulty signatures.

“Customers who have developed the most recent signatures do not need to take an action,” the spokesperson said.

Such problems are critical because security products like SCEP and Forefront are now Microsoft’s first and last line of defence for users against malware writers since Microsoft axed all support for Windows XP, and stopped releasing security patches for the ageing operating system, on April 8 this year. Windows Server 2003 remains supported until 14 July, 2015.

The advice for those still running Windows XP and Windows Server 2003 is to apply all the latest anti-virus patches and signatures to systems to try and stay safe. ®

Thanks to Reg reader Nik for the tip.

Beginner's guide to SSL certificates

More from The Register

next story
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
First in line to order a Nexus 6? AT&T has a BRICK for you
Black Screen of Death plagues early Google-mobe batch
Microsoft adds video offering to Office 365. Oh NOES, you'll need Adobe Flash
Lovely presentations... but not on your Flash-hating mobe
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.