This reminds me of a story.

In 2005, I was working at a large internet MMO gaming company (not that one, another one). We used a one program to patch and launch all of our different game executables. This was terrifically handy- one 780kb executable could download the entire assets for every single game, scan them for completeness, replace bad or missing files, and launch the game itself after you signed in. This was the Launcher, and it was bad ass.

This executable could also patch itself. Updates to this executable were fairly rare, but had to be made whenever a new title launched (but not for expansions) and when security holes were uncovered. In late 2005, a title was added to our lineup. To support it, we patched the launcher as usual. it connected to the central update servers, downloaded and applied a patch to itself, and restarted. So far, so good. For many people, this worked perfectly fine. The patch was tiny, the delay was only a few seconds, and they were up and running without missing a beat.

...but then we started getting calls. A lot of calls. For almost a week after this patch, we were inundated with support calls about the launcher opening whenever users tried to start any program. We were accused of hacking their system. Of installing spyware. Of trying to force them to play more often. I took one call from a man who was convinced his computer wanted to play with him- that it had become sentient and was acting like a dog bringing a chew toy to his owner.

As a senior tech at the time, I took it upon myself to try to figure this mess out. I got detailed process lists from people- what programs were launched at startup, what applications had been recently installed, what kind of firewall was being used, what kind of antivirus was installed, and so on. In the mean time, we had many angry users who were unable to play their games. Many just wiped their Windows installations and started from scratch. Some canceled their accounts. But some just wanted this damn launcher to get out of the way.

As I pored over the collected information from these users, one program was always there. There was one common thread among all of these affected users. McAfee antivirus. So I started looking into recent changes McAfee had made to their antivirus system. Then I found it. I struck gold- a perfect confluence of OS design flaw, vendor ignorance, and best practices gone awry. You see, McAfee had introduced a new "feature" with their combination Antivirus/Firewall program. One of the most insidious and short-sighted changes ever made.

When you installed McAfee with the Firewall protection, you had to create a whitelist of applications that could connect to the Internet. This was annoying at first, but you only had to allow a program through once. McAfee would make a hash of that executable file, and would allow it's communications to pass through the firewall every time thereafter. And you could turn this feature "off", though with McAfee, "off" is relative.

Users who had this antivirus solution installed had, at one time, allowed the launcher through their firewall. The first time they connected to us after the launcher patch was released, their executable would download it's patch, apply it to itself, and restart. But then the executable hash didn't match any more. And rather than asking users if they wanted to allow the program to connect to the internet, McAfee would rename the executable and move it- after all, it was changed after connecting to the internet, it was probably malware!

What did they name the file? Program.exe. Unless that was already taken, then they would name it Progra~1.exe or Progra~2.exe and so forth. And where did they place this file? Well, in the root directory of C of course!

Those of you unfamiliar with how arguments are passed to Windows programs won't understand the true horror of this decision. You see, back in the very old days (pre-1994) Windows did not support long file names. It wasn't until Windows NT 3.5.1 (and then Windows 95 later) that long file names were supported in Windows. Prior to this, there were a lot of limitations on what characters could be part of a filename or directory. And prior to the introduction, a space in a command written out in the shell indicated that what was to follow would be an argument. This made sense at the time. You would have a command, like this:

C:\DOOM\doom.exe -episode 3

And this would start the game "doom" with at episode 3. Simple- you have the path, you have the argument. Now, when Microsoft switched to Long File Names, it still had to support this type of invocation. So, the way the windows cmd.exe shell works is simple. You pass it a string like this:

C:\Program Files\id Software\Doom\Doom.exe -nomusic

And it will try to execute "C:\Program" as a file, passing it "Files\id Software\Doom\Doom.exe -nomusic" as argument to that executable. Of course, this program doesn't exist, so it will then try to execute "C:\Program Files\id", passing it "Software\Doom\Doom.exe -nomusic" as argument. If this doesn't exist, it will try to execute "C:\Program Files\id Software\Doom\Doom.exe" passing in "-nomusic" as an argument. It would continue this way until a program existed and started, or until the path was depleted and no program was to be found.

An additional wrinkle that I should mention. Desktop shortcuts on Windows are mostly just invocations of the shell, with the actual location of the executable you want to start- the path- stored in text inside the shortcut. When you click it, it reads this path, and passes it to the shell to start up the program. And this is why McAfee's process of moving files to the root directory was the worst decision they could have made. Most of the programs installed in Windows at this time were installed to the "Program Files" directory by default. This was a folder in the root (C:) directory. So when you wanted to launch, for instance, Microsoft Word, the shortcut on your Desktop pointed to "C:\Program Files\Microsoft\Office\Word.exe". or Firefox, which was in "C:\Program Files\Mozilla\Firefox\". Again, these are default paths- most of the time you have the option of installing someplace else.

Our users were trying to launch their application- applications which resided in the Program Files directory on their C:\ drive, but were getting the launcher instead. I was stupefied when I figured this out. Literally struck dumb. I had just uncovered what had to be the worst confluence of shortsighted decisions ever in my support career. I explained the problem to my boss, but he didn't know what to do with the information. I spent weeks trying to get in contact with McAfee about the issue. I wrote up instructions to help people delete the "Program.exe" files, disable their McAfee firewall, and how to reinstall the launcher.

Eventually, McAfee did respond to the issue. By this time, the work-arounds had resolved most of our customer's issues. I don't know how McAfee handles the detection of modified executables, but I hope they learned a little bit about Windows program invocation from this problem, and won't repeat the same mistake int he future.