Antivirus Webroot Deletes Windows Files, Causes Serious Problems For Users (pcworld.com) 67
Users of Webroot's endpoint security product, consumers and businesses alike, had a nasty surprise Monday when the program started flagging Windows files as malicious. From a report: The reports quickly popped up on Twitter and continued on the Webroot community forum -- 14 pages and counting. The company came up with a manual fix to address the issue, but many users still had problems recovering their affected systems. The problem is what's known in the antivirus industry as a "false positive" -- a case where a clean file is flagged as malicious and is blocked or deleted. False positive incidents can range in impact from merely annoying -- for example, when a program cannot run anymore -- to crippling, where the OS itself is affected and no longer boots. The Webroot incident falls somewhere in the middle because it affected legitimate Windows files and sent them to quarantine. This is somewhat unusual because antivirus firms typically build whitelists of OS files specifically to prevent false positive detections.
Not exactly big news. (Score:5, Funny)
I'm sure all three users were massively upset though.
Re: (Score:1)
And Webroot isn't exactly wrong either. ;)
I'd spin this as "BrickerBot for Windows" and bask in the praises of Slashdot.
Re: (Score:2)
McAfee has done something like this before [zdnet.com] As I recall it impacted Intel.
Is there a problem? (Score:5, Funny)
> the program started flagging Windows files as malicious
I don't see the problem. Works well.
Re:Is there a problem? (Score:5, Insightful)
Re: (Score:2)
You beat me to it; now if only it went the whole hog and forcibly installed an upgrade to Linux or BSD
Flags Windows as malicious (Score:4, Funny)
Re: Gahh (Score:2)
Re: (Score:2)
Windows *does* do that; it asks permission for anything you don't have rights to do. I don't use MacOS a lot, but it seemed to be very similar to how OSX did/does it.
Now, if you meant "ask permission to execute any .exe not on the whitelist", then yeah, I don't know of any OS that does *that*.
Re: (Score:2)
tight sandboxing and an ask-permissions-for-anything policy for the non-whitelisted stuff
This is the correct answer only if you are a competent IT admin.
But Webroot doesn't sell to enterprises. Or if they do, no one I know has ever bought them. Webroot sells to home users who know jack.
Home users will never have a viable means of addressing malware unless the device, OS, and applications are all managed for them. Expert users despise walled gardens, but they are the only real hope for most of the population.
False positive or truely negative? (Score:1)
Are they sure those Windows files weren't malicious? Just because they belong to the OS doesn't mean they should automatically be trusted, especially in Windows.
Every Antivirus has done this. (Score:5, Insightful)
Re: (Score:2, Insightful)
including microsoft's.
and, btw, microsoft did not "make their own".
they bought rav from gecad in '03, and giant antispyware in '04. those turned into onecare (later mse) and defender, respectively.
this is what they do: buy other companies or other companies technologies; and failing that, copy someone else's idea or product or poach their employees to recreate them.
Re: (Score:2)
Denial is not just a river in Egypt.
* List of mergers and acquisitions by Microsoft [wikipedia.org]
* Microsoft's "Innovations" [dwheeler.com]
Re: (Score:2)
Re: (Score:2)
> they bought rav from gecad in '03, and giant antispyware in '04. those turned into onecare (later mse) and defender, respectively.
Yup, those were Microsoft Acquisitions [wikipedia.org] #72 and #77, respectively.
Re: (Score:2)
So, pretty much like any company ever, then?
Reasons for not Microsoft (Score:4, Informative)
In the era of Microsoft's own AV, there is no need for a third-party AV installed on Windows.
Nope, quite the contrary : There IS need for third-parties too.
The more diverse the antivirus landscape is, the more AV virus-writer needs to test their creations against.
Avoid monoculture !
It's harder when a Virus needs to go unnoticed by all of Microsoft AV, Kaspersky AV, Avira, F-Prot, Clam, etc. rather than only the first one on the list.
Re:Reasons for not Microsoft (Score:5, Funny)
P.S. I agree. Diverse 3rd party products do help make the bad guys job harder.
Re: (Score:3)
In the era of Microsoft's own AV, there is no need for a third-party AV installed on Windows.
Not according to Microsoft. They say that Defender is intended as a fallback to provide some level of protection when no other antivirus is installed. It is not intended to provide full anti-malware protection.
Well On The Bright Side (Score:5, Funny)
Not False Positive (Score:1)
It found NSA malware hidden code in .dll files
Re: (Score:2)
Re: (Score:2)
Sounds like he's talking about md5 collisions. But that's not the cause of AV false flags.
Re: (Score:2)
Yes, multithread that file scan! That way, both your disk *and* your CPU can be pegged full-time, and any potential viruses won't have any CPU time or IO available to do anything nefarious!
Another day in the Windows world (Score:5, Insightful)
In other news (Score:1)
Microsoft announced today the acquisition of the Webroot Antivirus program in order to incorporate its detection technology into Microsoft Defender. Steve Ballmer is quoted as saying, "No one fucks with our users, well...except for us, and this provides an excellent means by which to do so."
Not the first time this has happened. (Score:2)
The company I was working at in 2010 was effectively shut down for a day when McAfee flagged and quarantined svchost.exe.
http://www.theregister.co.uk/2... [theregister.co.uk]
It has to be said... (Score:2)
"Users of Webroot's endpoint security product, consumers and businesses alike, had a nasty surprise Monday when the program started flagging Windows files as malicious."
If the files in question are from Win 10, then it's pretty much a case of Webroot just doing its job.