Feeds

Eset false alarm puts system files on remand

Kryptik cock-up

Beginner's guide to SSL certificates

Slovakian anti-virus firm Eset has confirmed that a misfiring virus definition update wrongly labelled Windows system files as infected with malware.

As a result of the dodgy definition key files were identified as a virus and shuffled off into quarantine. Eset said it spotted the problem within minutes and released a new update that was free of the glitch, along with advice on how to unbork affected systems.

The firm estimates that less than one in 20 users were affected. It apologised for the snafu in a statement which explains that mistakes in virus definition and generic detection (heuristic) updates contributed to the problem.

On Monday March 9th 2009 at 5:52 CET, ESET released an update of our heuristics v.1091 together with standard virus definition update no. 3918. An error in the heuristics caused a malfunction in the Windows operating system by false identification of several system files including dllhost.exe, and msdtc.exe, which were catalogued as Win32/Kryptik.JX.

The update downloads were stopped within 10 minutes of the update release, and the update was reverted to its previous version. Thanks to this immediate reaction, less than 5 per cent of our users were affected.

False alerts involving anti-virus scanners are a well-known Achilles Heel which affects all vendors from time to time. The issue is more severe when system files are miscategorised as malware, as in this case, but Eset deserves credit for responding promptly to the issue.

Eset has published advisories explaining how affected users can pull files out of quarantine and restore systems here and here. "A new special update containing automatic release of the false positives from quarantine will be released within a few hours," it added.

In response to the incident, Eset said it was working on a standalone tool to manage quarantined files more efficiently in large installations. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
SHELLSHOCKED: Fortune 1000 outfits Bash out batches of patches
CloudPassage points to 'pervasive' threat of Bash bug
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.