Comment Re:For a program so hard to turn off (Score 3, Insightful) 472
And that antivirus program would be susceptible to many types of viruses that modify system files. This particular virus that it detects (W32.Wecorl.a) does change svchost.exe:
http://www.symantec.com/security_response/writeup.jsp?docid=2008-110306-2212-99
What McAfee should have is a better way of quarantining critical system files (replace with known good copies, have a robust patch/repair process for system files, have a more stringent fingerprint detection, etc). Maybe a whitelist of known good md5sums for system files (of course, this would have to be updated with every version of those files ever released in any patch by Microsoft).