Feeds

McAfee AV ate my application

False Trojan horse alert causes chaos

  • alert
  • submit to reddit

The Essential Guide to IT Transformation

An Australian software developer has been left fuming after the latest virus definition update from McAfee caused his package to be wrongly identified as a Trojan horse programme.

The false positive meant that ISPWizard, an internet setup program wizard, was labelled as the BackDoor-AKZ Trojan by users running the latest update of McAfee's AV software. As a result, ISPWizard is being unceremoniously ripped from users' systems. This means that many people are unable to connect to their ISPs because the software that they need has been automatically deleted by McAfee.

McAfee's cock-up dates from 1 September when it released an antivirus DAT (signature file) update. It has yet to rectify its mistake.

ISPWizard Developer Mark Griffiths slammed McAfee's tardy response: "This is causing major problems for my business, the businesses of my customers [ISPs] and also their customers as well. Despite this problem being quickly reported to McAfee and it being stressed to them that this is a major problem which is causing damage to many businesses, they have been very slow to react," he said.

"Although they have now responded and admitted that this is a problem with their software, they have still not released a new update to their DAT files to fix the problem and say that it may take until Thursday [9 September] before it is actually released. In the meantime, the software continues to misidentify my software as being infected by a Trojan. End users that are being affected are either contacting the ISP for assistance and blaming them for distributing a Trojan - greatly increasing the support burden and costs for the ISP, or they are simply switching to another ISP," he added.

Other AV vendors (for example, Sophos) detect the BackDoor-AKZ Trojan without interfering with the operation of ISPWizard. "I'm not aware of any other anti-virus program that is misidentifying my software at the moment," said Griffiths.

So why is McAfee AV misdiagnosing a benign program as malignant? We don't know. Our repeated calls and emails to McAfee over the last two days failed to generate a response from the company

In copies of email correspondence between Griffiths and Avert Labs, McAfee's AV research division, a suggestion was made that the misdiagnosis could have arisen because components of ISPWizard were created with the same package as components of the backdoor Trojan program. But this remains only a theory. McAfee has offered Griffiths a temporary DAT file that end users would need to manually install on their systems as a workaround. Griffiths is unimpressed with the offer: he is frustrated that McAfee has not released an emergency automatic update. ®

Related stories

Email deletion bug baffles McAfee
Murder on the Outlook Express
McAfee virus update damages NT 4.0 files
McAfee virus update freezes PCs
Email deletion bug bites Norton Internet Security
Symantec undeletes mail deletion bug

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.