If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Microsoft Anti-Spyware Deleting Norton Anti-Virus
FYI
--------------------------------------------------------- Security Fix Brian Krebs on Computer Security Microsoft Anti-Spyware Deleting Norton Anti-Virus Microsoft's Anti-Spyware program is causing troubles for people who also use Symantec's Norton Anti-Virus software; apparently, a recent update to Microsoft's anti-spyware application flags Norton as a password-stealing program and prompts users to remove it. According to several different support threads over at Microsoft's user groups forum, the latest definitions file from Microsoft "(version 5805, 5807) detects Symantec Antivirus files as PWS.Bancos.A (Password Stealer)." When Microsoft Anti-Spyware users remove the flagged Norton file as prompted, Symantec's product gets corrupted and no longer protects the user's machine. The Norton user then has to go through the Windows registry and delete multiple entries (registry editing is always a dicey affair that can quickly hose a system if the user doesn't know what he or she is doing) so that the program can be completely removed and re-installed. I put in calls to Microsoft and to Symantec on this issue, but am still waiting to hear back from both companies. Microsoft said it is shipping updates that fix this problem, but judging from the growing number of other threads on this in that forum, this is shaping up to be a pretty big issue for companies that have deployed Microsoft's free anti-spyware product inside their networks. It's a good idea to keep in mind that Microsoft's Anti-Spyware product is in beta mode: The company's product page explicitly says that Microsoft Anti-Spyware should not be deployed in production systems. I'm not apologizing for Redmond in any way; it just seems like too many people ignore warnings about beta products. Update: 10:58 p.m. ET: I heard from Microsoft, and they say the problem is limited to customers running Symantec Antivirus (SAV) Corporate Edition versions 7, 8, 9 or 10 or Symantec Client Security (SCS) versions 1, 2 or 3 in combination with Windows AntiSpyware Beta 1. "The beta software will prompt and allow the user to remove a registry key containing subkeys belonging to these Symantec products. The deletion of these registry keys will cause all versions of the SAV and SCS software to stop operating correctly. No files are removed in this situation, only registry keys." The rest of the statement Microsoft sent me says: "Once this issue was discovered, Microsoft quickly released a new signature set (5807) to remove this false positive. Both companies are working jointly together to identify the number of affected customers, which we believe to be very limited. Microsoft and Symantec are working jointly on a solution to restore normal operation of the Symantec software. Until this solution is available, customers can utilize System Restore in Windows XP to restore to an earlier point prior to the removal of the registry keys, or reinstall their client software." By Brian Krebs | February 11, 2006; 01:42 PM ET TrackBack TrackBack URL for this entry: http://blog.washingtonpost.com/cgi-bin/mt/mtb.cgi/4708 |
#2
|
|||
|
|||
Microsoft Anti-Spyware Deleting Norton Anti-Virus
In article ,
(known to some as Sparky Spartacus) scribed... FYI --------------------------------------------------------- Security Fix Brian Krebs on Computer Security Microsoft Anti-Spyware Deleting Norton Anti-Virus snippety A nice fix exists for this situation, and it can be summed up in one URL: http://www.grisoft.com Happy tweaking. -- Dr. Anton T. Squeegee, Director, Dutch Surrealist Plumbing Institute (Known to some as Bruce Lane, KC7GR) http://www.bluefeathertech.com -- kyrrin a/t bluefeathertech d-o=t calm "Salvadore Dali's computer has surreal ports..." |
#3
|
|||
|
|||
Microsoft Anti-Spyware Deleting Norton Anti-Virus
Or even http://free.grisoft.com
along with http://www.sunbelt-software.com/Kerio.cfm (it is free for individuals after the timeoutperiod of 1 month) and the microsoft antispyware will keep things quiet for a while... L "Dr. Anton T. Squeegee" wrote in message ... In article , (known to some as Sparky Spartacus) scribed... FYI --------------------------------------------------------- Security Fix Brian Krebs on Computer Security Microsoft Anti-Spyware Deleting Norton Anti-Virus snippety A nice fix exists for this situation, and it can be summed up in one URL: http://www.grisoft.com Happy tweaking. -- Dr. Anton T. Squeegee, Director, Dutch Surrealist Plumbing Institute (Known to some as Bruce Lane, KC7GR) http://www.bluefeathertech.com -- kyrrin a/t bluefeathertech d-o=t calm "Salvadore Dali's computer has surreal ports..." |
#4
|
|||
|
|||
Microsoft Anti-Spyware Deleting Norton Anti-Virus
"Sparky Spartacus" wrote in message ... FYI (snip) I'm sure this has nothing to do with the fact that MS is getting into the AV business in a more aggressive way. (g) And I won't even comment about NAV. Dead horse. Stew |
#5
|
|||
|
|||
Microsoft Anti-Spyware Deleting Norton Anti-Virus
That was fixed almost immediately withg an update 5807.
That issue is also nonexistant with the Beta 2 release of Windows Defender which was just released, the successor of Microisoft AntiSpyware. An unfortunate false positive. -- Jupiter Jones http://www3.telus.net/dandemar http://www.dts-l.org "Sparky Spartacus" wrote in message ... FYI --------------------------------------------------------- Security Fix Brian Krebs on Computer Security Microsoft Anti-Spyware Deleting Norton Anti-Virus Microsoft's Anti-Spyware program is causing troubles for people who also use Symantec's Norton Anti-Virus software; apparently, a recent update to Microsoft's anti-spyware application flags Norton as a password-stealing program and prompts users to remove it. According to several different support threads over at Microsoft's user groups forum, the latest definitions file from Microsoft "(version 5805, 5807) detects Symantec Antivirus files as PWS.Bancos.A (Password Stealer)." When Microsoft Anti-Spyware users remove the flagged Norton file as prompted, Symantec's product gets corrupted and no longer protects the user's machine. The Norton user then has to go through the Windows registry and delete multiple entries (registry editing is always a dicey affair that can quickly hose a system if the user doesn't know what he or she is doing) so that the program can be completely removed and re-installed. I put in calls to Microsoft and to Symantec on this issue, but am still waiting to hear back from both companies. Microsoft said it is shipping updates that fix this problem, but judging from the growing number of other threads on this in that forum, this is shaping up to be a pretty big issue for companies that have deployed Microsoft's free anti-spyware product inside their networks. It's a good idea to keep in mind that Microsoft's Anti-Spyware product is in beta mode: The company's product page explicitly says that Microsoft Anti-Spyware should not be deployed in production systems. I'm not apologizing for Redmond in any way; it just seems like too many people ignore warnings about beta products. Update: 10:58 p.m. ET: I heard from Microsoft, and they say the problem is limited to customers running Symantec Antivirus (SAV) Corporate Edition versions 7, 8, 9 or 10 or Symantec Client Security (SCS) versions 1, 2 or 3 in combination with Windows AntiSpyware Beta 1. "The beta software will prompt and allow the user to remove a registry key containing subkeys belonging to these Symantec products. The deletion of these registry keys will cause all versions of the SAV and SCS software to stop operating correctly. No files are removed in this situation, only registry keys." The rest of the statement Microsoft sent me says: "Once this issue was discovered, Microsoft quickly released a new signature set (5807) to remove this false positive. Both companies are working jointly together to identify the number of affected customers, which we believe to be very limited. Microsoft and Symantec are working jointly on a solution to restore normal operation of the Symantec software. Until this solution is available, customers can utilize System Restore in Windows XP to restore to an earlier point prior to the removal of the registry keys, or reinstall their client software." By Brian Krebs | February 11, 2006; 01:42 PM ET TrackBack TrackBack URL for this entry: http://blog.washingtonpost.com/cgi-bin/mt/mtb.cgi/4708 |
#6
|
|||
|
|||
Microsoft Anti-Spyware Deleting Norton Anti-Virus
S.Lewis wrote:
"Sparky Spartacus" wrote in message ... FYI (snip) I'm sure this has nothing to do with the fact that MS is getting into the AV business in a more aggressive way. (g) And I won't even comment about NAV. Dead horse. I had to re-activate NAV after installing MS's latest high priority updates Wed (inc. their Malicious Software Tool). I don't think MS has all the bugs out quite yet. |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Technician for Spyware and Virus | WebWalker | General | 0 | December 9th 04 02:05 PM |
Anti Virus | hawk | Homebuilt PC's | 22 | April 21st 04 01:47 AM |
Warning: Latest Norton Auntie Virus update breaks InCD | Howard Kaikow | Cdr | 17 | October 15th 03 02:11 PM |
Norton Anti Virus 2004 sends computer into reboot loop | Glenn M | Homebuilt PC's | 6 | September 26th 03 03:31 AM |
Flood of virus and patch warnings from Microsoft. Is a new worm loose or is it spam? | Phil Weldon | Overclocking | 28 | September 21st 03 05:34 AM |