Microsoft OneCare deletes entire mailboxes

James Bannan
12 March 2007, 1:09 PM


Turns out that OneCare isn't that great at protecting your system. It just might delete your email too, just for the heck of it.


Not only has OneCare recently come last in a recent online comparative test of antivirus applications, it’s making life miserable for Windows users too by deleting their entire mailboxes in certain circumstances.

A bug which caused serious problems during OneCare’s beta builds has reared its ugly head again. After a system malware scan, OneCare quarantines – effectively deletes – Outlook and Outlook Express PST and DBX files.

Although a fix will be pushed out to OneCare subscribers, the official workaround is the same as it was during the beta program. Users are directed to register these file types as exceptions in OneCare’s quarantine filter so that they’re not picked up in the scan. Files which have been quarantined but not deleted can be recovered from within OneCare’s quarantine feature.

According to Microsoft, this problem affects Outlook 97/2000 and Outlook Express running on Windows XP. There’s no record yet of it affecting later versions of Outlook or Windows Vista.

Such a bug is certainly an embarrassment for Microsoft, and doesn’t bode well for OneCare’s ongoing uptake, but arguably that’s what beta testing is for – find the bugs and fix them. The fact that this bug was found was allowed to slip back in the final release is inexcusable. Beta testing only works through users’ goodwill, and the understanding that work done to identify problems early on results in a more polished final product.

This sort of massive slip-up is damaging to user confidence, and public perception of Microsoft’s products is bad enough without this sort of avoidable situation compounding the problem.

Maybe users need a malware application to protect themselves from OneCare?

UPDATE: Peter Watson, chief security advisor, Microsoft Australia has issued the following statement in response to APC's story:

On Sunday March 11, the Windows Live OneCare team released a new anti-malware engine that will fix the issue of OneCare erroneously quarantining certain Outlook .pst or Outlook Express .dbx files when infected files were detected within them. Windows Live OneCare customers whose PCs are connected to the Internet will automatically get this fix.  We apologise for any inconvenience this has caused our customers.

Again, OneCare will automatically update for this fix and customers will not need to take action to update themselves, but any customers who wish to manually confirm that they have received the most recent anti-malware engine can do so via the following steps:

1. Click “Change OneCare Settings” in the Main OneCare user interface

2. Click the “Logging” Tab

3. Click the “Create support log” button

4. Scroll down to the “Virus and Spyware Versions:” section and check your AM Engine version number.  If the text says the numbers “2306” after the 1.1. number – such as AM Engine:(1.1.2306.0) – your engine has been updated already.  If “2306” does not appear, your engine may still need updating.  To update, ensure your computer is connected to the Internet, then click the “Check for updates” link in the main OneCare user interface and OneCare will download and install the fix.

For customers whose Outlook .pst and Outlook Express .dbx files had been quarantined prior to this fix and engine update, we continue to recommend the following steps to recover their email:

1. Close Outlook or Outlook Express

2. Click Change OneCare Settings in the Main OneCare user interface

3. Click on the Viruses & Spyware Tab

4. And then click on the Quarantine button and then select the pst or dbx file and then click on Restore.


Post your comment



Comments

RSS feed Email alert

raindog:

The cynic in me says that only attacking older version could be almost by design. The realist in me say that going by Microsoft's recent efforts any deliberate knobbling of older systems would have been screwed up in actual implementation.

One care? What about Duty of Care?

And these are the guys that think I'll shell $751.oo for a new release of an old operating system in a plastic box.

29 February 2008, 8:30 PM (3 years ago)report abuse Send to a friend reply

Wes:

The fact that it affects only older versions may suggest that no tests were done on those older versions and could mean that most beta testers may have been using later versions of the applications.

This also shows that you cannot rely on beta testing alone to test a major application because beta testers are not going to go out of their way to test older versions and other variations of applications but it's up to Microsoft to do that. In this case its their products involved and so should be easy for them.

29 February 2008, 8:30 PM (3 years ago)report abuse Send to a friend reply

raindog:

Wes there is not to rely on Beta testing provided that testing is performed in a scientific manner.
It is the responsibility of the developer to ensure their Beta test program has adequate penetration across all facets of the user base.
If Microsoft see the only user base of importance is the cashed up fanboys with overblown hardware and latest and greatest patched OS's, then they should clearly state "Untested on older Software versions".
A Windows 2K box with office 2K and half a gig of RAM is still a perfectly functional box for business use, yet it appears Microsoft is pulling out all stops to accelerate the redundancy of pre-existing systems.







29 February 2008, 8:39 PM (3 years ago)report abuse Send to a friend reply

tin:

Most beta testers would have likely been running Vista and Office 2007 at the time, wouldn't they?
Still, it makes you wonder how they didn't realise it would quarantine an entire PST file. Those damned files are their own invention.

29 February 2008, 8:39 PM (3 years ago)report abuse Send to a friend reply

tin:

Could it be that part of the problem is that MS don't listen to bug reports?
I reported a bug in Outlook Express some years ago, and I beleive it's still there. Sure it's only a minor GUI bug, but it's still a reported bug.

And I'm sure we all know about the various bugs that have not been fixed until proof of concept exploits were released.

29 February 2008, 8:30 PM (3 years ago)report abuse Send to a friend reply

raindog:

I could have sworn that there was a Microsoft reply here that James Bannan posted? Mental note: go easy on the drink.

29 February 2008, 8:30 PM (3 years ago)report abuse Send to a friend reply

john:

You don't have to be a subsriber to "onecare" for Vi$ta to wipe your mailbox. Vi$ta Home Premium will wipe your incoming and outgoing mail anyway.

29 February 2008, 8:30 PM (3 years ago)report abuse Send to a friend reply

anonymous user Anonymous user