False Positive with CA and Windows Update

After applying the most recent virus update (7318) Windows Update fails
to work properly. When accessing the page I get a message asking me to
install the software for Windows Update. When I click on "Install" I get
a pop up message from CA saying that it has detected
win32/asuspect.haeof in wuweb.dll and quarantined it. Then windows
update does not continue. This is happening on all three of our
computers. Windows update worked fine immediately before applying this
update. When I do a complete virus scan it comes up clean. CA confirms
there is a False positive and they are working on it.

Thanks for posting this warning for CA Users, Sharon.

http://homeofficeforum.ca.com/homeof...1581#post21581

Sharonf, can you please explain what `recent virus update (7318)' you are
talking about. Is this a CA update, or part of the number in a Windows
update (Kb.......7318).

Sorry, 7318 is the latest CA product update which was released today.

It took them (CA) TWO updates to fix this!

7321 does NOT fix it...

7323 DOES...

If you have copies of wuweb.dll in "quarantine" due to CA:

1) Make sure you have updated the signatures to at least 7323, and
2) Restore the file(s) from quarantine.

NOTE:
I have had customers that still had the following in CA quarantine from a
PRIOR bout of "false positives"...

REG.EXE
NETSH.EXE
et. al.


"sharonf" wrote:

> After applying the most recent virus update (7318) Windows Update fails
> to work properly. When accessing the page I get a message asking me to
> install the software for Windows Update. When I click on "Install" I get
> a pop up message from CA saying that it has detected
> win32/asuspect.haeof in wuweb.dll and quarantined it. Then windows
> update does not continue. This is happening on all three of our
> computers. Windows update worked fine immediately before applying this
> update. When I do a complete virus scan it comes up clean. CA confirms
> there is a False positive and they are working on it.
> .
>

This is not the first time this has happened can't anything be done about
this so it doesn't happen again and again?

"sharonf" wrote:

> After applying the most recent virus update (7318) Windows Update fails
> to work properly. When accessing the page I get a message asking me to
> install the software for Windows Update. When I click on "Install" I get
> a pop up message from CA saying that it has detected
> win32/asuspect.haeof in wuweb.dll and quarantined it. Then windows
> update does not continue. This is happening on all three of our
> computers. Windows update worked fine immediately before applying this
> update. When I do a complete virus scan it comes up clean. CA confirms
> there is a False positive and they are working on it.
> .
>

Although no anti-virus solution is immune to "false positives," the CA
product (in the past) has either had minimal impact or quick response to
correct these types of errors...

This latest fiasco has had a nearly 24 hour outage, and an admittedly "low
priority" attitude by CA that will probably result in many lost customers for
them...

I have been recommending the FREE Microsoft Security Essentials as a
replacement product recently with good results. The only downside to MSE
that I see so far is a slightly higher CPU load, but it has been (IMHO) a
good replacement so far. (And the price is right!)

"crypticuser" wrote:

> This is not the first time this has happened can't anything be done about
> this so it doesn't happen again and again?
>
> "sharonf" wrote:
>
> > After applying the most recent virus update (7318) Windows Update fails
> > to work properly. When accessing the page I get a message asking me to
> > install the software for Windows Update. When I click on "Install" I get
> > a pop up message from CA saying that it has detected
> > win32/asuspect.haeof in wuweb.dll and quarantined it. Then windows
> > update does not continue. This is happening on all three of our
> > computers. Windows update worked fine immediately before applying this
> > update. When I do a complete virus scan it comes up clean. CA confirms
> > there is a False positive and they are working on it.
> > .
> >

I have this same problem sudden;y this morning, Will CA be providing any
OFFICIAL support for this problem???

"Rob" wrote:

> Although no anti-virus solution is immune to "false positives," the CA
> product (in the past) has either had minimal impact or quick response to
> correct these types of errors...
>
> This latest fiasco has had a nearly 24 hour outage, and an admittedly "low
> priority" attitude by CA that will probably result in many lost customers for
> them...
>
> I have been recommending the FREE Microsoft Security Essentials as a
> replacement product recently with good results. The only downside to MSE
> that I see so far is a slightly higher CPU load, but it has been (IMHO) a
> good replacement so far. (And the price is right!)
>
> "crypticuser" wrote:
>
> > This is not the first time this has happened can't anything be done about
> > this so it doesn't happen again and again?
> >
> > "sharonf" wrote:
> >
> > > After applying the most recent virus update (7318) Windows Update fails
> > > to work properly. When accessing the page I get a message asking me to
> > > install the software for Windows Update. When I click on "Install" I get
> > > a pop up message from CA saying that it has detected
> > > win32/asuspect.haeof in wuweb.dll and quarantined it. Then windows
> > > update does not continue. This is happening on all three of our
> > > computers. Windows update worked fine immediately before applying this
> > > update. When I do a complete virus scan it comes up clean. CA confirms
> > > there is a False positive and they are working on it.
> > > .
> > >

Rob,

When you say update the signatures, do you mean to make sure the most recent
update is loaded (i.e. 7323) or do I have to track down the actual file on my
computer and check signatures on it?

I found the other files you mentioned in my quarantine. Was the Win32/AMalum
also a false postivie. I have a number of files quarantined with that listed
as the infection from 2009. Do I need to restore all of them as well or just
the most recent false positive?

Thanks!

> 1) Make sure you have updated the signatures to at least 7323, and
> 2) Restore the file(s) from quarantine.
>
> NOTE:
> I have had customers that still had the following in CA quarantine from a
> PRIOR bout of "false positives"...
>
> REG.EXE
> NETSH.EXE
> et. al.
>

See this ongoing discussion:
http://homeofficeforum.ca.com/homeof...ad.php?&t=6813
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002


sharonf wrote:
> After applying the most recent virus update (7318) Windows Update fails
> to work properly. When accessing the page I get a message asking me to
> install the software for Windows Update. When I click on "Install" I get
> a pop up message from CA saying that it has detected
> win32/asuspect.haeof in wuweb.dll and quarantined it. Then windows
> update does not continue. This is happening on all three of our
> computers. Windows update worked fine immediately before applying this
> update. When I do a complete virus scan it comes up clean. CA confirms
> there is a False positive and they are working on it.

It's now a *NINE* page thread and counting ...
http://homeofficeforum.ca.com/homeof...?t=6813&page=9


MowGreen
================
*-343-* FDNY
Never Forgotten
================

banthecheck.com
"Security updates should *never* have *non-security content* prechecked


PA Bear [MS MVP] wrote:
> See this ongoing discussion:
> http://homeofficeforum.ca.com/homeof...ad.php?&t=6813

Boy, the s*** really hit that fan, didn't it? Meanwhile, I'm waiting for
this OP & CA Internet Security user to reply to her thread:
http://aumha.net/viewtopic.php?t=43497


MowGreen wrote:
> It's now a *NINE* page thread and counting ...
> http://homeofficeforum.ca.com/homeof...?t=6813&page=9
>
> PA Bear [MS MVP] wrote:
>> See this ongoing discussion:
>> http://homeofficeforum.ca.com/homeof...ad.php?&t=6813