McAfee sparks Controversy -- are they misleading users to Upgrade?

by Dennis Faas, infopackets editor
http://www.infopackets.com
 

Update May 24, 2002

Since this article's publishing, I have received 1 email and 1 phone call from McAfee associates.  Suffice to say, the information provided in this article was never challenged.

Preamble

The article illustrates many contradictions discovered on the mcafee.com and mcafeeb2b.com web sites which prove to be confusing and misinforming.

Due to its length, this article has been paraphrased and edited on other web sites.  Before sending in a comment or suggestion to the editor, please refer to this web site as the official "source" of information regarding this issue.

--

March 25, 2002

This week, my hard drive suddenly became corrupt and I lost over 35 gigabytes of information. While I was lucky enough to salvage my most important files, the rescue operation took over 8 hours to complete.

Did my firewall fail and allow hackers to gain control of my system? Was I missing the latest Windows fix from Microsoft's Windows Update web site? Did I forget to update my virus scanner?

Uncertain what caused the corruption of my hard drive, I decided to double-check the three possibilities. I quickly moved down the list: my firewall was up to date; there were no new Windows updates from Microsoft. The only other option was to ensure that my McAfee virus scanner had the latest virus definitions (DAT).

I visited the McAfee web site to check for the latest DAT update (http://download.mcafee.com/updates/updates.asp). To my surprise, the link which normally pointed to the latest DAT was replaced with a link, "Upgrade to VirusScan 6.02 now!" At the top of the page, there was a brief message which read:

• "Attention VirusScan 3.x and 4.x Retail/Home users:
  
  Your versions of VirusScan are out of date and are no longer supported. Please Upgrade to VirusScan 6.0 now to ensure that you are protected against new Virus threats."

	This is the message from mcafee.com stating all VirusScan versions 3.x and 4.x are "no longer supported."

Further down the page, there was a link which pointed to a message from the Sr. Director of AVERT labs, Vincent Gullotto, stating that "scan engines 4.0.50" were now obsolete:

• "Official Statement from AVERT regarding engines 4.0.50 and older and their EOL (End Of Life)"

I was now certain that I had to upgrade my virus scanner. I pondered the idea; should I decide to continue using Mcafee as my anti-virus solution, it would cost $39.95 to upgrade -- a mere $10 savings off the full purchase price. I remembered hearing news that Network Associates was going to buy out Mcafee, and wondered if this was related to the sudden push to purchase the VirusScan 6.0 upgrade. I decided to do some more surfing to see if I could dig up any more information on the topic.

Recall that -- according to mcafee.com -- "4.x Retail/Home users" were required to "upgrade to VirusScan 6.0." According to this statement, that included the version that I was running, which was 4.03a. While surfing, I hap-hazardly stumbled upon another McAfee web site, called McAfee "B2B" (business to business). The web site displayed a heading directly above their DAT update link "To Use with Version 4.03 and later Products". Up until this point, I always relied on mcafee.com site to update my virus definitions. Thinking that I misread some information concerning the compatibility of my existing VirusScan and the DAT file which was before me, I compared both sites for similar information. I was able to come up with some interesting findings.

	If you click on the "Virus Scan 5.x and 6.x" link on the mcafee web site, it takes you to this page where you can obtain the 4193 DAT update.

	This capture was taken from the mcafeeb2b web site which shows a conflicting heading between this picture and the above.

What concerned me the most is that the main mcafee.com web site had seemingly gone to great lengths to remove the SUPER DAT update link which would not only update VirusScan to the current DAT release, but also upgrade the scan engine to version 4.1.60 -- making all virus scanners with at least version 4.03 still valid.

	This is the infamous message which says that all 3.x and 4.x VirusScan users must upgrade.  Normally one of these links would lead into the SUPER DAT update page which would not only update the DAT, but would also update the scan engine.

I found more information on the mcafeeb2b web site that confirmed my supposition; the page states that the 4.1.60 engine will reach its end of life (EOL) in December 2002 -- 8 months from now (http://www.mcafeeb2b.com/naicommon/download/eol.asp). Again, this information conflicts with the message displayed on mcafee.com.

	Here is the End Of Life for engine 4.1.60, slated for December, 2002 -- 8 months AFTER mcafee.com says that users are required to "upgrade to VirusScan 6.0."

Furthermore, there is a readme.txt file via the FTP download via on the mcafeeb2b web site which states that the latest DAT file is indeed updatable for VirusScan 4.0.3 users:

• "You may use 4193XDAT.EXE to update all supported version 4.0.3 and later anti-virus product releases, including version 4.5.x releases."

	More conflicting information from the mcafee FTP site which states that DAT update 4193xdat.exe is supported by VirusScan 4.03.

http://a64.g.akamai.net/7/64/2015/2002-03-22-08-00-00-780/download.nai.com/products/datfiles/4.x/NAI/readme.txt

Again, this finding was inconsistent with the message displayed on the mcafee.com web site. FYI: The SUPER DAT (4113k, includes engine update to 4.1.60) update is available from the mcafeeb2b web site:

http://www.mcafeeb2b.com/naicommon/download/dats/superdat.asp

I found even more discrepancies in the headings provided on both mcafee.com and mcafeeb2b.com sites regarding what scan engines could use the current DAT. On mcafee.com, there is a heading below the latest DAT file, "McAfee VirusScan 5.x or higher and Dr. Solomon 8.x DAT File Update"; on the mcafeeb2b site, the same file was listed under the heading "To Use with Version 4.x Products". Note that although the file size is listed as being different on both sites, they proved to be identical files. I tested this theory by downloading each file from both sites, compared their file sizes, and executed each file to see if they were indeed the same. Note, however, that both 4193xdat.exe files -- which are 1.9 megabytes each in size -- report being a SUPER DAT file during the installation procedure, but do not include the engine update as the SUPER DAT included at the mcafeeb2b web site does (a 4.1 meg file):

(http://www.mcafeeb2b.com/naicommon/download/dats/superdat.asp).

The 4193xdat.exe for scan engines greater than 4.03 are available here, and do not include the engine upgrade:

http://download.mcafee.com/updates/4xa.asp
http://www.mcafeeb2b.com/naicommon/download/dats/mcafee_4x.asp

Confused? Maybe that's the name of the game.

I decided to look at some press releases regarding the buyout and found two interesting articles: one from internet.com and the other at mcafee.com. The article at internet.com said that if Network Associates was to buy out Mcafee, they would be "streamlining operations and eliminate confusion across business units."

Internet News:

• "Network Associates, which provides anti-virus, network management, and help desk software, said the decision to acquire the remainder of McAfee.com was an attempt to streamline operations and eliminate confusion across business units."

http://www.internetnews.com/ent-news/article/0,,7_992981,00.html

McAfee.com:

• "As required by the federal securities laws, McAfee.com anticipates that within ten business days after formal commencement of the exchange offer by Network Associates, its board of directors will advise stockholders of McAfee.com whether it recommends acceptance or rejection of the exchange offer..."

http://www.mcafee.com/aboutus/press_room/press_releases/Mar182002_1.asp

Does streamlining infer that I will be forced to upgrade to version 6.0? While the evidence is not conclusive, it seems all too convenient that during the time of a preeminent buy out, the sudden push to have consumers upgrade to VirusScan version 6.0 is under way. More interesting is the fact that the option to upgrade comes 8 months early before the actual end of life is scheduled to take effect. With confusing download headers, the absence of SUPER DAT links on the main site, and the neglect to completely inform users of the VirusScan's true life span, McAfee's practice seems to be seedy and admittedly "confusing", to say the least.