Feeds

Chinese user sues Symantec over dodgy updates

Unpalatable

The essential guide to IT transformation

A Chinese user's attempt to sue Symantec for damage caused as a result of dodgy anti-virus signature update files is unlikely to succeed, according to security experts.

Liu Shihui, a solicitor based on Southern Guangdong Province, is suing Symantec for 1,644 Yuan ($215) for damage caused by a signature update of Norton Anti-Virus which identified two core Windows XP files as potentially malicious.

As previously reported, Symantec software wrongly identified two system files (netapp32.dll and lsasrv.dll) in the simplified Chinese version of Windows XP SP2 as the Haxdoor Trojan following a faulty update issued on 18 May.

In standard configurations on Norton Anti-Virus these files are deleted, resulting in problems subsequently booting systems. Fixing systems involves copying these files from backup CDs.

Liu's lawsuit, reckoned to be the first of its kind in China, could open the floodgates for similar claims. But security experts are skeptical of the possibility of the action succeeding because of Symantec's limited warranty.

"Obviously I'm no expert in Chinese law, but here in the West, an action of this type is unlikely to succeed because of the warranty conditions that IT vendors normally apply to their software," said Phil Higgins, a senior partner with systems integrator Brookcourt Solutions.

All apologies

Symantec said that shortcomings in systems designed to automatically respond to fast-evolving malware threats were responsible for the problems experienced by Chinese-speaking users of its software. It's apologised to them and promised to learn lessons from the SNAFU.

Users of Pegasus, the popular email client package, were also hit by similar problems due to Norton anti-virus signature updates last month.

False alert

False positives among anti-virus packages are an industry-wide issue. In March 2006, a signature update from McAfee falsely identified components of MS Office as a low-risk virus.

In another similar incident, MS anti-spyware labelled security software from rival Symantec as a Trojan back in February 2006. A dodgy update from Trend Micro floored the PCs of many who applied it, irrespective of what other apps were running.

The security behemoth promised to review the problems caused by recent false detections in order to prevent the repetition of similar incidents in future. It declined to comment on Liu's lawsuit.

In a statement prompted by our questions on its recent reliability problems, Symantec said: "Symantec Security Response uses a variety of automated systems to complement manual analysis in order to provide rapid response times to new threats. The automated processes have run successfully for several years and have allowed Symantec Security Response to dramatically increase the number of high quality malware detections it's able to provide, especially with the continued increase in the number of threats faced by customers.

"In response to the increased use of encryption in malware, a change was made to the automation recently to deal with these malware more effectively. This inadvertently resulted in a change to a single definition used by the automated system and subsequently led to two files being falsely detected as malware.

"Symantec was notified of the false detection on 17 May at 18.30 PST and after an investigation was initiated, it was quickly determined that the automated system was the cause of this false detection. The false detection was immediately removed from the definitions. Symantec Security Response then initiated a LiveUpdate posting to include the updated definitions. This LiveUpdate became publicly available at 22:50 PST, approximately 4.5 hours after Symantec was notified of this issue.

"Symantec has been reaching out to its customer and partner network, to provide them with the updated file definition and the necessary steps to prevent further issues. Symantec is working to ensure customer issues are resolved in a timely manner. Symantec remains committed to this market and values its customers in China," it added. ®

5 things you didn’t know about cloud backup

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.