RSSOneCare Deletes Users' Outlook Files
By Scott M. Fulton, III | Published March 9, 2007, 4:16 PM
A rash of users of Microsoft's new Windows Live OneCare service, launched last January 30, have been reporting on Microsoft's support forums that virus scans performed by the service have resulted in the deletion of their OUTLOOK.PST files - the local, centralized repositories of e-mail, scheduling, and collaboration data used by Outlook.
"This new version of OneCare did the damage to my computer no virus had ever done before," wrote one user last January 25. Since that time, a volunteer Microsoft MVP was struggling to help users cope with not only their deletions, but suggestions and advice from phone-based Microsoft support personnel managed to exacerbate many users' problems, in some instances rendering their Outlook files non-recoverable.
Only yesterday did a Microsoft official make a certified response, saying, "This issue will be fixed in the next engine update, scheduled for Tuesday, March 13." In the meantime, he advises users to manually enter an exemption into their OneCare settings for the personal files folder where the .PST file is kept.
Based on a read of excerpts from log files submitted by impacted users, OneCare chooses not to be explicit about how it chooses to mitigate or alleviate the threats it encounters. Users' logs include notices that begin, "Windows Live OneCare found potentially harmful or unwanted software on your computer." From there, they identify the file names of the .PST files in question, and identify specifically the classification and type of threat discovered. That much is certain, until the log entry concludes with, "Threat Status: Removed."
An Outlook .PST file includes the images of all e-mails a user receives through her local or personal accounts, such as from Internet ISPs or Web-based e-mail services. Attachments to e-mails, even if they appear to be documents, are also encapsulated in this single file. By contrast, Exchange accounts enable these components to be stored and maintained on the server, though the localized portion of account files is still stored within an .OST file on the client.
So if a user at some point in time received a file in her e-mail that contains even a latent virus package, that virus is considered part of the .PST file by OneCare. While it doesn't have the capability to weed through and extract parts from the .PST file like a database - or like Outlook itself - it can detect a virus' signature through a binary scan of the entire .PST file.
What OneCare then apparently tries to do is quarantine the .PST file as a whole, which would render Outlook useless, but only temporarily. Typically, this means the file is transferred into a safe system folder which cannot be accessed by normal means. But it's here where OneCare has apparently been dropping .PST files from the system, and in such a way that third-party recovery tools can't seem to grab them back.
Smart OneCare users had gone so far as to back up their .PST files to separate locations, in the event that a virus -- or a virus scanner - should inadvertently impact their active .PST file. But if the backup file also contained a virus, then users discovered OneCare would attempt to quarantine it as well, with just as disastrous results as with the active file.
With Microsoft's dramatically increased focus on security over the past three years, some OneCare users have been left wondering why it's even possible for the critical .PST file to be deleted by anyone or anything, without raising a red flag somewhere? "Why in the world would they even think of deleting or erasing a .PST file without asking permission first?" one user writes.
Another user cited a portion of an e-mail apparently from technical support personnel, which tried to explain why the .PST file wasn't really deleted - it just looked that way because it wasn't listed anywhere in the computer. "It is not a problem with Live OneCare," the e-mail stated, without explaining what it is a problem with. It then went on to suggest that if the user actually did find the .PST file anywhere, however, he should delete it himself lest he risk damage to his computer from a virus.
Showing a bit of sympathy for the volunteer MVP on the OneCare forum who was left without a solution for over a month, another user wrote, "Leaving you, the MVP, twisting in the wind...is no way to run a railroad. Staggering incompetence on the product group's part."
Then last Wednesday came this post from a certified public accountant, which showed some patience for the fact that bugs happen, but a degree of intolerance for how he feels Microsoft managed the problem: "Software problems occur. Nothing is perfect. But companies I deal with normally are all over software updates to correct a problem. And we are talking about Outlook, a highly used software that holds critical data for most of us, especially business users...I almost get the feeling Microsoft does not really care about this product, that they came up with it just so they could enter this software market."
Microsoft has OneCare....REVENUE! Outlook should use a SQL express backend or even an Access mdb would work better than a "Pathetic Storage Trick" or .PST flat file. Then again, with all the bugs in SQL2K5 Managment Studio, maybe we really are better off already, and we don't even know it.
Ignorance is bliss....oops...I forgot...they changed it to Microsoft Dumb. And I like these guys...go figure.
Score: 0
OneCare has been doing this since it was in beta. I lost my PST file in the summer last year and informed MS about the error (many hours on the phone). Guess they still didn't fix it!
Score: 0
Almost as nice as when NOD decided all WinRAR self extracting files were infected and deleted them.
That's when I switched to KAV.
Backups? Well, ok. So you tell users to run this or that to sync their critical files.
Since your users have 1Gb+ PST files, you sync them, not archive them.
OneCare deletes the PST, the sync comes along and faithfully removes the copy on the backup drive.
I had a VP of Operations that kept messages in trash for a month then filed them to other folders. Got a call about Outlook not doing this or that. Sent someone up while the VP was in a meeting. The guy saw over 1000 items in trash, deleted them, compacted the PST. Outlook open quite fast after that, yet the user was not happy...
Score: 0
Try using SyncToy with the Contribute setting. That'll will sync changes from the master (first) folder (and optional subfolders) to another location, without deleting anything.
That VP should have known better. Things in the Trash are by nature subject to being purged. If they were that important, then they wouldn't be in the trash. He only has himself to blame for a lousy habit. (I might sound somewhat mean, but you really do have to wonder what some people are thinking.)
http://rinkworks.com/stupid/ Computer Stupidities
Score: 0
You'd be a bit foolish to set your backup program (whatever it is) to sync file deletions without creating backup copies. Personally I don't sync file deletions at all - if I really need to remove something, I can easily remove it in all backup locations. :P
Score: 0
OneCare... Thats an oxymoron. And your a moron if you buy it.
Score: 0
Informative and thoughtful, as always.
/sarcasm
Score: 0
I is buys the softwaring for my 3 computing devicages....lol
Hey, I love MS and I love their products, not everything is free and perfect in the world but you use what you use right?
Peace be with you friend.
Score: 0
Can you translate that into English? Or perhaps add a little punctuation: I have no idea what you're trying to say.
Score: 0
http://www.av-comparatives.org/
Decide for yourselves which AV app is the best.
I liked Norton until it became so incredibly bloated.
Score: 0
So many of them are bloated now. Favouring NOD32 at the moment - it's the only one that doesn't significantly slow-down modern PCs (even Core 2 systems).
Score: 0
Windows OneCare? hahaaaah... one screendoor hatch in a submarine
... DIVE DIVE DIVE
Outlook took a dump on me a couple weeks ago for who knows what reason, but after trying to get it working for a few hours, I just gave up and started using Thunderbird.... Damn... what took me so long ?
Score: 0
More proofs that Microsoft cannot be trusted. That is not a bug, is a catastrophe.
Microsoft allways did security trough obscurity, but now they saw the light! They are doing this for good: Next revision will wipe the entire hard disk, so the scanner will take shorter to complete next time! Isn't that good? That way, they will be able to claim "the fastest scanning ever"!
Score: 0
The biggest problem that I have seen is that when errors such as this are encountered, it is almost impossible for the consumer to break through the wall of anonymity that Microsoft and other software developers wrap around themselves to prevent consumers from actually contacting the vendor about a problem. In most cases, software companies even ignore Better Business Bureau and state's attorney general complaints, at the advice of legal council, to avoid the acceptance of any liability.
Score: 0
Onecare does this to MSN mailfiles as well but they didnt do anything about it.
Score: 0
Kaspersky. The one and only!
The best UI, the best detection rate, the best proactive technology out there.
PS This is my personal IMHO as a computer related specialist. Everyone must decide for self trying different solutions.
Score: 0
Only problem with Kaspersky is lag the hell out of you.
Score: 0
If it is proactive abillities (and polymorphic) you want you're better off with Eset's NOD32. Kaspersky relies heavily on their signature-database.
I agree with you on it being one of the best AV scanners out there but personally NOD32 meets my needs.
Score: 0
Indeed - Kaspersky is great for cleanup duties, but it's system requirements are too great for everyday use, IMHO - even on modern PCs.
Score: 0
More useless non-working software from Microsoft.
I hear that there are 9000 switchers a day moving to Apple.
I will be one of them soon. :)
Score: 0
hmm... let's assume that stat is accurate and also say that there are about 100 million Microsoft customers (a number that's insanely low, we probably should be talking 5 to 10 times as much at least). 100,000,000 MS customers / 9,000 switchers per day = ~11,111 days or about 30 years for all MS customers to switch. sorry, could resist.
Anyway, I've been in the perpetual beta for OneCare since the beginning but I think I'm finally going to switch to NOD32 or something similar. For an all-in-one AV/anti-malware/backup/tune-up program I thought OneCare ran really well, but now there's just so many strikes against it.
Score: 0
You will have no regrets if you choose NOD32.
Score: 0
We welcome you too greener pastures soon.
Score: 0
"100,000,000 MS customers..." You really made me laugh.
Thats business customers numbnuts.
Do your research before you look stupid again. LOL
Score: 0
I'd like to see a link verifying the 9,000 per day number.
I'd also be curious to know how many people per day come back to windows after trying apple.
Score: 0
Very few.
Score: 0
http://opinion.zdnet.co....0002208,39286244,00.htm
Agree with this story.
Microsoft's continued silence on this is chilling. I don't care if it's a product for pre-school children, customer data loss?
Score: 0
_ONE_ could _CARE_ less
Score: 0
It's COULD NOT care less.
Why do people have such a problem with this phrase?
If you COULD care less, it defeats the purpose of saying you don't at all care.
Score: 0
lol
Score: 0
MICRSOFT RIP
Conversation with some IT nerds 50 years from now, so you have heard about this superpower Microsoft back in the early 21st century.
The one that deleted itself?
The one that formatted itself.
Score: 0
good lord that was lame.
Score: 0
accurate though...
Score: 0
wow can't they create one software that doesn't have bugs.
Score: 0
Name one software vendor that releases perfect software everytime.
Score: 0
Nope, not that complex. Could you? Could *anyone*?
Hint: The answer is: No.
Score: 0
I reckon I could write a bug-free "Hello World." ;)
Score: 0
I bet you could. It's not complex. :)
Score: 0
Is this a case where "cancel or allow" didn't work?
Let's see...so the concept of testing a fix is not included in MS's policies and procedures???
If it was anyone else I would be surprised. But with MS there is simply too much precedence to do anything but to smile and to act surprised...
Score: 0
This happened to me. Restored the quarentined file, put the PST on the ignore list...it was hard work.
Score: 0
First off, let me state that this was a major, MAJOR oversight by Microsoft. Between this issue and the recent refusal of two anti-virus testing groups to give OneCare any certification, it's shaping up to be a bad week for Microsoft. (And just wait until Sunday arrives.)
On the other hand, what business would rely on OneCare to be their primary anti-virus software? The most likely folks who were affected were the SOHO users who run a business out of their home, or use their home systems to connect to company computers remotely. In that case, the users should have been using the company-certified anti-virus solution instead of trusting Microsoft to protect their computers. If you're following your company's security guidelines (the one I work for is running over 50 pages long) then you should have the anti-virus software and firewall software from your organization, along with a router that's been configured, and a host of other settings.
I don't totally blame Microsoft, as too often the end user tends to never think about what they are doing. But Microsoft bears a large burden of the blame as it was their software and someone in QA blew it big time.
Score: 0
Oh, you think? !!!
--->First off, let me state that this was a major, MAJOR oversight by Microsoft.
Score: 0
OneCare was programmed to work too good, unfortunately. That is, find threats and eliminate them.
Outlook: "Threat removed". ;)
Score: 0
*lmao*
Exactly... :D
Score: 0
*laughs*
Next update includes even better definitions:
IE with ActiveX - "Threat removed." ;)
Score: 0
Okay, this is just pathetic. Microsoft just nailed the lid on their own coffin with this one...
Score: 0
Uh...yea, MS is dead...sure.
LOL
Score: 0
MICRSOFT RIP
Conversation with some IT nerds 50 years from now, so you have heard about this superpower Microsoft back in the early 21st century.
The one that deleted itself?
Score: 0
That might be a tad overstated. They messed up to be sure, but it's not something new to the industry. Every single AV product on the market has deleted files that should not have been deleted. They all go through it.
Yeah, this one's pretty bad...and would likely cause me to stop using the product if I had used it.
I highly doubt it's Microsoft's Death Knell, though. At the moment, they derive very little actual income from this product.
Score: 0
This is one of reasons why i'll NEVER EVER go back to local mailboxes. Mail services with several gigabytes storage, accessable from anywhere in the world as long as you can grab a computer with net connection. MS Hotmail Live and GMail come to my mind...
Score: 0
As much as this is a stupid/dangerous problem to have, it isn't unique to OneCare and Outlook. I've seen other AV software do the same thing with Thunderbird's mail store in the past.
Score: 0
I do agree with you there. Norton has removed Spybot S&D on people's computers a year or so ago too, as well as .pst files, certain legitimate .doc files, the frikin windows pinball game (pinball.exe--that one cracked me up, lol), and even Lightning Download's exe file was detected as a false positive a while back.
Score: 0
The last time I used Mcafee and never looked back is after it ran on it's own and removed about 2/3 of the uninstallers on my PC. This was after 1 def. In a couple hours...yes, HOURS, the def. was updated again. They all make mistakes...it's just a matter of who's scanning when the mistake is made and what program provider is able to push new defs before the problem becomes major.
I would'nt be too affected by this. 95% of my email is now stored online and all my contacts are stored and backed up redundantly on Plaxo. The only issue for me would be if my phone AND pc had an issue simultaneously. The plaxo info isn't as extravagant as outlook (it doesnt save pics and ring preferences) so I'd have to re-customize. But at least I'd have it all back within 5 mins.
Online is the way people. Like someone else said.....move to gmail, live, lycos, aol - they're all online and gbs of storage. No reason to stay local anymore unless it's the type of mail that circulates within Intel that needs to be...um...'sanitized' and 'misplaced'.
Score: 0
Amazingly, I liked the look, feel, and performance of this software in the past. I hated Norton. Now I am hearing great things about Norton 360 (for the novice, of course. No real techie worth their salt uses AV).
Score: 0
"(for the novice, of course. No real techie worth their salt uses AV)"
I actually do, but only to alert me to a potential problem. Once it finds a virus, I exterminate it myself (even when the AV program does it, I have to clean the scraps it leaves behind 99.9% of the time.) I use AVG Free at my house because it is lightweight, but has decent detection. It's not the best, but the best is always expensive and uses more resources which I dislike more than I do the viruses themselves.
Score: 0
"No real techie worth their salt uses AV"
Plz turn your computer off, and go into a career flipping burgers. You've just proven yourself worthy.
Thanks.
Score: 0
Many techs don't use AV. Some do. And some who don't probably should. ;)
Personally, I don't - on my personal box. On any machine someone else has access to, AV is installed. :P
Score: 0
Wow! I would go ape$&@! if I lost my .PST file.
Score: 0
That's why you backup routinely.
Score: 0
You should try Thunderbird. It works great.
Score: 0
Backups are also pst files - you see the predicament now? lol. Unless the user were to back it up online or completely offline ie: a storage device which is not scanned for viruses, then either way you're screwed.
Score: 0
DVD or a separate drive excluded from scans. There should be no need to ever scan a storage device for malware. So what predicament? There isn't any.
Score: 0
No need to ever scan a storage device for malware? Okay.... Hard drives are storage devices, not just DVD drives. And you can get malware from CDs, DVDs, Flash drives, and handhelds. Not to mention floppy drives.
I'm guessing you mean backup storage. I would still scan them at least once in a while, just in case.
Score: 0
Yes, I do mean - separate - backup storage. I certainly don't backup to my production drive. And you wouldn't backup data that hasn't first been scanned, would you? That's all I mean by not scanning a storage device. There should be no need to.
Score: 0
A virus could still infect backups. It could have been missed when the backup was made or it could do its dirty work when the backup is connected again (and proper security procedure aren't followed). One example would be a coworker connecting it to their computer to take a look at it. Unless the media was completely read-only at that point (e.g. a finalized CD-R), it could become infected.
Score: 0
The mistake here is two-fold.
#1 - they didn't catch this through dogfooding. How is that possible?
#2 - Deny it, and it's not a problem. Unless it's a problem, and then you look like an idiot.
Score: 0
From reading the OneCare support forum, it appears that this bug was fixed after the original beta, and then reintroduced when they fixed something else. The reason it slipped through is that it only affects older versions of Outlook that are no longer supported by MS, but are still used by some customers. I guess MS didn't test the final versions against versions that fall outside of mainstream support.
I also don't believe they denied it was a problem. What they failed to do was attach a high enough priority to fixing it, because very few people actually contacted their support rep; they went to the support forum instead, which seems to have very little say in when a problem gets escalated. Even though the problem is isolated to non-supported versions of Outlook, the bad press that has been generated by this, should make MS look again at how it handles problems, even if support isn't contacted directly.
Score: 0
This is nearly as bad as the time some antivirus software marked lsass.exe as a virus. At least it was fixed very quickly. I'm glad I stick by NOD32. I'm sure we'll get the unusual fanboys in trying to defend, and the general senseless posts criticizing Microsoft, forever looking for an excuse. I play for neither field.
You can say only this: it's a poor mistake, which should have been quickly rectified. It's clear they need to evaluate their practices, and where they want to focus their energy.
Score: 0
Bwahahahahahahahahahahahahahaha. Any of you MSN Apologists have a defense for this?
Score: 0
Nope. they fuked up.
*shrug*
no-one's No-one's perfect. Easy fix, though.
Good thing I use NOD32.
I'd love for you to name one popular AV software that hasn't broken things in the past though. Just for fun, ya know.
Score: 0
Ouch, the stupid, it hurts! Thanks for the curse word, we appreciate you sharing your lowbrow ms apologies once again. Could you be anymore predictable?
Score: 0
Symantec has been great, they all have issues but this is a PROBLEM and deleting PST is bad.
You guys should use www.r-tt.com to recover it if your are impacted that product works great.
Score: 0
@zridling:
Great characterization of the tool! Good stuff. It's nice to hear someone of your reputation taking a stand.
Score: 0
Avast!! has never broken or removed anything I didn't want removed in over two years of use. Can't speak for others, just my experience you know.
Score: 0
Avast is good, and you can't beat free.
Score: 0
Reputation?
For what? Being an immature ranting fool?
Well, if that's what you want to be when you grow down...
Score: 0
Love it, Zaine. Really. You built this lovely tribute to your own inadequacy in my honor. More-over, you did it 2 clicks from your full name and email address.
Takes brains, man. Real brains.
You call me a troll, and yet I can't seem to find *one* post from you that is anything more than flames or ignorant MS bashing.
This is just another example in the long list. You can't argue anything I stated above, so you've decided to flame and insult, showing your vast maturity.
Grow up.
You claim to be intelligent. I've read your blog and thus have serious doubts, but on the off-chance that I am wrong, prove it.
Show us you have some basic critical thinking ability, some level of maturity beyond that of a third-grader. Try, just *try* to once post something relevant, informative, and intelligent.
Score: 0
Been hearing AntiVir is pretty good as well. May have to give that one a try.
Score: 0
Most of us - myself included - launch an occasional barb at others in this forum, but what you posted in your blog that can only be perceived as hate-mongering filth is revolting. There is no need for that garbage. And you're 46? ...Scary.
Score: 0
You still havent figured out what an immature a** your making yourself out to be have you...
Score: 0
Debatable - AntiVir is good if it's compatible. Too many machines have rejected it though (when we were using it regularly). AVG seems fairly compatible though, as far as freebies go.
Score: 0