SCF Advanced Search

  • Total Posts: 40520
  • Total Topics: 14428
  • Online Today: 599
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)

Author Topic: Eset false alarm puts system files on remand (Win32/Kryptik.JX)  (Read 3281 times)

0 Members and 1 Guest are viewing this topic.


  • SCF Administrator
  • *****
  • Posts: 7528
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • - Samker's Computer Forum

Slovakian anti-virus firm Eset has confirmed that a misfiring virus definition update wrongly labelled Windows system files as infected with malware.

As a result of the dodgy definition key files were identified as a virus and shuffled off into quarantine. Eset said it spotted the problem within minutes and released a new update that was free of the glitch, along with advice on how to unbork affected systems.

The firm estimates that less than one in 20 users were affected. It apologised for the snafu in a statement which explains that mistakes in virus definition and generic detection (heuristic) updates contributed to the problem.

    On Monday March 9th 2009 at 5:52 CET, ESET released an update of our heuristics v.1091 together with standard virus definition update no. 3918. An error in the heuristics caused a malfunction in the Windows operating system by false identification of several system files including dllhost.exe, and msdtc.exe, which were catalogued as Win32/Kryptik.JX.

    The update downloads were stopped within 10 minutes of the update release, and the update was reverted to its previous version. Thanks to this immediate reaction, less than 5 per cent of our users were affected.

False alerts involving anti-virus scanners are a well-known Achilles Heel which affects all vendors from time to time. The issue is more severe when system files are miscategorised as malware, as in this case, but Eset deserves credit for responding promptly to the issue.

Eset has published advisories explaining how affected users can pull files out of quarantine and restore systems here: and here:  "A new special update containing automatic release of the false positives from quarantine will be released within a few hours," it added.

In response to the incident, Eset said it was working on a standalone tool to manage quarantined files more efficiently in large installations.

(The Register)

Samker's Computer Forum -


  • SCF Newbie
  • *
  • Posts: 6
  • KARMA: 2
Re: Eset false alarm puts system files on remand (Win32/Kryptik.JX)
« Reply #1 on: 10. March 2009., 22:48:24 »
I was one of the unlucky "less than one in 20", as well as a large number of our servers.  How they estimated that number, I don't know, but I'm skeptical at best.

Unfortunately, when Windows recognized the system files (dllhost.exe and msdtc.exe) were modified, I was prompted to replace them with originals from the XP SP3 disc...  I did, and 1 reboot later and nothing but blue screens.

In my 6 years of using McAfee Enterprise 8.x, I've never encountered this.


  • SCF Member
  • **
  • Posts: 17
  • KARMA: 2
Re: Eset false alarm puts system files on remand (Win32/Kryptik.JX)
« Reply #2 on: 11. March 2009., 01:43:10 »
i believe mcafee is number antivirus, so i recommend it most pc users.

Samker's Computer Forum -

Re: Eset false alarm puts system files on remand (Win32/Kryptik.JX)
« Reply #2 on: 11. March 2009., 01:43:10 »


With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters)

Enter your email address to receive daily email with ' - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising