NEW YORK: Anti-virus programme maker McAfee Inc. has admitted that its update for a number of virus-scanning products caused havoc Friday in corporate and consumer systems using the virus protection products when a virus definition file triggered the quarantine or deletion function for several executable files, including Microsoft's Excel.
The problem occurred when the company released its DAT file -- or virus definition file -- No 4715 as part of a daily updating routine and intended to refine McAfee anti-virus products' capability to catch the W95/CTX virus. In a matter of minutes, the company's customers started seeing an unusual number of files being quarantined or deleted by scans using the newly-released update.
While excel.exe was the most affected, the list of exe files released by McAfee as having affected by the update was of seven pages. Users complained that the anti-virus programme tried to remove files including Perl, Sysinternals' PcTools suite, various Oracle binaries, Dell OpenManage, Google Toolbar installer and programs that run Macromedia Flash Player, Sun's Java application and Adobe update manager.
The system either deleted the concerned files or removed them into a separate folder as per settings decided by the user. McAfee claimed the files were moved or deleted during scheduled or manual scans and not during background scanning.
The company said it had reports from some 100 customers and it immediately released an updated definition file, DAT 4716 and a tool designed to restore automatically all the wrongly quarantined files.
McAfee said the problem arose in updates for VirusScan Enterprise 8.0i, 7.1 and 7.0; Managed VirusScan 4.0 and 3.5; Virus Scan Online 11 and 10; Linux Shield; and VirusScan 7.03 (consumer). As a result of the error, the update identified the files as W95/CTX, a virus discovered in 2004.
McAfee's director of operations at its AVERT Labs Joe Telafici said the flawed update went out at 10.35 PST Friday and in about two hours, the company started getting reports of the malfunctioning. The company pushed its corrected update a couple of hours after that at 3.28 p.m. PST, he said.
Telafici said the quarantined files could be restored with the corrected update, but deleted files would require a more elaborate procedure. The company has suggested on its website that users should go to a backup or use Windows XP's System Restore feature to roll back the machine to a point before the flaw occurred.
The flaw seems to have happened as a result of what is described as "false positives", which are common in spam detection. It mostly happens as a result of mistaken identity -- when a security researcher finds a malicious file and tags its filename as belonging to a virus or worm, but does not realise that the same filename can be used by a legitimate program.
Telafici said this was a combination of unusual circumstances. "There was one byte off in a signature, and there was a hole in our testing process."
