Topic: Eset false alarm puts system files on remand (Win32/Kryptik.JX)

[Samker]

Slovakian anti-virus firm Eset has confirmed that a misfiring virus definition update wrongly labelled Windows system files as infected with malware.

As a result of the dodgy definition key files were identified as a virus and shuffled off into quarantine. Eset said it spotted the problem within minutes and released a new update that was free of the glitch, along with advice on how to unbork affected systems.

The firm estimates that less than one in 20 users were affected. It apologised for the snafu in a statement which explains that mistakes in virus definition and generic detection (heuristic) updates contributed to the problem.

    On Monday March 9th 2009 at 5:52 CET, ESET released an update of our heuristics v.1091 together with standard virus definition update no. 3918. An error in the heuristics caused a malfunction in the Windows operating system by false identification of several system files including dllhost.exe, and msdtc.exe, which were catalogued as Win32/Kryptik.JX.

    The update downloads were stopped within 10 minutes of the update release, and the update was reverted to its previous version. Thanks to this immediate reaction, less than 5 per cent of our users were affected.

False alerts involving anti-virus scanners are a well-known Achilles Heel which affects all vendors from time to time. The issue is more severe when system files are miscategorised as malware, as in this case, but Eset deserves credit for responding promptly to the issue.

Eset has published advisories explaining how affected users can pull files out of quarantine and restore systems here: http://kb.eset.eu/esetkb/index?page=content&id=SOLN2181&actp=LIST_RECENT and here: http://kb.eset.com/esetkb/index?page=content&id=SOLN2181&actp=LIST_RECENT  "A new special update containing automatic release of the false positives from quarantine will be released within a few hours," it added.

In response to the incident, Eset said it was working on a standalone tool to manage quarantined files more efficiently in large installations.

(The Register)

[madskyllz]

I was one of the unlucky "less than one in 20", as well as a large number of our servers.  How they estimated that number, I don't know, but I'm skeptical at best.

Unfortunately, when Windows recognized the system files (dllhost.exe and msdtc.exe) were modified, I was prompted to replace them with originals from the XP SP3 disc...  I did, and 1 reboot later and nothing but blue screens.

In my 6 years of using McAfee Enterprise 8.x, I've never encountered this.

[whales]

i believe mcafee is number antivirus, so i recommend it most pc users.