OSNews

And it is why you pay for support and testing from them. They reality is, most of these corporate user don't have proper IT department.

The best way for them would be a network anti malware solution. Blocking them in a gateway before they are installed. Signature check can be done on packet too, not just files... (and yes, it does slow your internet connection and your intranet, but just as much as anti virus slow your computers).

Well, my original comment didn't quite come across the way I'd intended, and the edit timeout bit me. I meant to stress the and, as in why are they running Windows *and* relying on Antivirus *instead* of locking the systems down? That's what the policies and mmc are for after all and, while they can be a big pain in the ass and obscure at times, they're far more effective than any Antivirus could ever be. Lock them down, then use a gateway/firewall/network-based AV solution to check traffic from the outside in. split the subnets, so that if they do have a public access point it doesn't get anywhere near the corporate environment. Lock down the browser, forbid the user to install *anything*, and do not let any existing software automatically update. These steps would eliminate the need for per-system antivirus if they really must use Windows. If they're going to secure their Windows machines, they need to do it right.

Which leads us to the next question, why does one need to lock down the system in the first place. Why is it not delivered with services off by default and configuration hardened. Why am I turning the majority of stuff off instead of turning just what I need on?

In terms of auto-updates, was this a program patch or something delivered through Mcafee's signature updater? It seems to be a signature issue that decided svchost.exe was malicious. Antivirus is probably the one category of software that should be updating it's signature files and scanning engine automatically. This puts the responsibility on McAfee for pushing a bad signature file update.

If it was something like a bad Windows update, I'd be all over the municipality asking why they don't have compitent IT. For an AV data file update it's more understandable.

Even if everything you just said made sense, its still wrong. Why? HIPAA requires antivirus for all the reasons you don't understand.

You really think they had a competent admin... they probably can't afford one with the politicians sucking up all the money.