Microsoft Anti-Spyware Removes Norton Anti-Virus

An anonymous reader writes "According to a story over at Washingtonpost.com, the latest definitions file for Microsoft's Anti-Spyware beta flags Symantec's Norton Antivirus products as a password-stealing trojan and prompts users to delete portions of the program. Users who follow the instructions hose their installation of Norton, requiring delicate Windows registry edits and a complete removal/reinstall of Norton. Microsoft's support forum is quickly filling up with complaints about this problem, many from businesses that have been pretty hard hit. This should be a cautionary tale about deploying beta products in production environments."

http://it.slashdot.org/article.pl?si...59232&from=rss
Slashdot | Microsoft Anti-Spyware Removes Norton Anti-Virus

Ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha-ha!!!!!!!!!

Yes it is rather amusing, as are the readers' comments on the thread that was posted.

However:

Quote:

---

Microsoft's support forum is quickly filling up with complaints about this problem, many from businesses that have been pretty hard hit. This should be a cautionary tale about deploying beta products in production environments."

---

I have three comments:

1. If you have any idea and experience of beta testing security products, you always treat their findings with a degree of circumspection. You should expect false positives

2. In a business environment, when a "password stealing trojan" is reported, your first question should be "how in hell did it get in here?" and do some research on it. That would tell you what the files really were, and you would then scan them with other products for confirmation.

3. it doesn't say very much for Microsoft's pre-release testing does it? And this is a beta, so there should not be the same time pressures for releases? Anyway, Norton isn't exactly what I would call an obscure product, so it should be in their test environment, given that conflicts between security products are common.

:)

Heh heh heh, now if you are like me.....you would consider Norton to be Malware and not be surprised at all that it was picked up.

I really don't like Nortons or how hard it is to completely remove from a computer after it has been installed on it.

In my experience, in a small business business environment, when a "password stealing trojan" (aka keylogger) is found, the first question is actually "What is a keylogger?". Users have no clue. In fact, I had a client call me last Monday asking me what it meant when Norton's finds a keylogger. This is a guy who trades tens of thousands of dollars worth of stocks daily from that computer. I explained to him what a keylogger is and that he should get it off his PC asap. He told me Norton's was blocking it and when I pressed him for the exact message Norton's was giving him, he couldn't recall exactly what it was, or anything more specific that Norton's may have told him. He then told me he figured it was related to a program, VNC, I had installed days earlier for him. I called him Wednesday just to follow up and he said the keylogger was now showing up on his laptop, the one he does his company's accounting on. When I talked to him again on Friday and asked him if there were anymore messages from Norton's, he said there were none and he figured the keyloggers were gone. Ce la vie?

This guy blew off my suggestion to do an online AV scan. He apparently feels more threatened by looking stupid or having to pay someone than he does by a rogue program hiding on his
PC recording all his keystrokes. I see this chit week in and week out.

Hi brokencrow

Your story is oh so familiar! I get exactly the same myself :D the point is that they call US rather than the AV provider or Microsoft.

What sort of rang alarm bells for me, and prompted my comment was:

1. They were running a beta of a security product. To do that they would have to know about it, find it, then download and install it.

2. The complaints were appearing on the Microsoft Support Forum.

Now, neither of those circumstances fit the profile of the users that you describe. The guys we deal with wouldn't be able to do #1, and would not know that #2 existed?

This suggests at least partially computer literate people, and is frightening because it implies they know how to do something, but not what it is that they are doing :eek:

Quote:

---

A little learning is a dangerous thing..........

---

or something like that? :D

He-heh, nihil, I wasn't taking you to task. Those are all good points you raise. As for "partially computer literate people", they probably have been some training, which is too bad. Folks who are trained often suffer diminished cognitive abilities.

Like I'm fond of saying, "Training is what you do with your dog."

:p

Hi brokencrow

Quote:

---

He-heh, nihil, I wasn't taking you to task

---

I know that you were not, we were just "crying in eachother's beer" (sharing bad experiences) :D

On reflection, the totally illiterate are probably preferable? at least they tend to ask us first and pay for it, rather than screw up and expect us to fix it for nothing ;)

Cheers :)

Yeah, the comments at Slashdot are hilarious (I need a laugh). I'm reminded of a wannabe tech who was explained to me once why he didn't like HijackThis. He told me it always screwed up Windows so bad when he removed EVERYTHING it found, he had to reinstall. YAR!

Greeting's

{OFFTOPIC}

With BLACK TUESTDAY having 7 patches with 5 *CRITICAL* and now this I think Microsoft is just commited to give us a VALENTINE gift but sadly bill style :(

/{OFF TOPIC}

Quote:

---

Fooled me once, shame on me- fooled me at least 15 to 20 times- well I guess I should assume you are trying to fool me on any future attempts. (convicted of stealing competitors products, well known tendency of breaking competitors products by tweaking the operating system, well known tendency to slow competitors products by tweaking the operating system or using illegal API's and still certifying product, bundling, giving away products for free until the competition is dead then never innovating, "embracing and extending" java, j++, the halloween memoes, "collaborating" on products with a competitor and then bringing out their own version using knowledge they picked up during the collaboration, etc. etc. etc.).

They are not just another large capitalist company. They are something unique and they want to lock that in forever. They bought or drove out of business every legitimate business that competed with them either legally or illegally (Stak/doublespace comes to mind- there are others).

---

Quote:

---

What Microsoft wants is to kill all competitors by 'cutting off their oxygen supply'. BTW, every other IT company is seen as a competitor. This is ingrained in the corporate culture, and starts at the very top with Gates/Balmer. That is why no one trusts them

---

http://slashdot.org/article.pl?sid=0...tid=109&tid=95

Yeah, I'm paranoid. What about it?
:cool:

Quote:

---

This should be a cautionary tale about deploying beta products in production environments.

---

Except it has absolutely nothing to do with beta-ness. Just about every anti-malware app has issues with false positives on occasion -- that's why you normally review what it finds before blindly removing stuff.

Quote:

---

Originally posted here by @tt!tud3
Except it has absolutely nothing to do with beta-ness. Just about every anti-malware app has issues with false positives on occasion -- that's why you normally review what it finds before blindly removing stuff.

---

But the average user doesn't review the results of a malware scan - after all, the results are malware because the program says so, right? I've heard that the average Microsoft admin isn't exactly a specialist either, so that's probably why the companies are complaining.

I agree with nihil though, because it is their fault for using a beta program in the first place - and even then not checking the results (for something like that) is just complacent. There are plently of stable malware scanners out there anyway...

Cheers,

-jk :)

It happens to everyone including SYMANTEC. :) Trend Micro is another big player with a recent screwup.

Hmm well i'm starting to think my choice on not using the beta has paid off then. ;)
anyhow it shouldn't be to long before it's all ironed out and the thing comes out of beta mode.
That's when the real fun starts huh.?. :D

Well thats the thing when the product is very popular. One screw up can get out of proportion. It is however normal for Anti-Spyware applications to conflict with AV products and the like. False Positives are common obstacles with AntiSpywares or AVs.

But on a more realistic note, no matter how perfect the software is, it will still be useless if the user is well.... technologically impared.

If only the user can read and understand the warning, he/she can choose to remove/keep the detected "malicious file".

The FP can be quickly repaired, but user incompetence... well lets just say it will take generations before it gets fixed lol.

I'm wondering if this program has an exclude option. We have some company software that kept showing up on AVG. All I had to do is put the software on the exclusion list. The biggest threat Nortons gives is uninstalling and eating up all your resources.

Wonder if that's why they released Windows Defender (Beta 2) so early?

A.J.

Getting into thread a bit late but one thing that must be said is that things are much better than they were. I remember norton borught out an antivirus update once that rebooted all the PDC and BDC in a windows NT4 domain. It interesting watching about a 100 DC dropping one after another while the guy in charge of security at the time was trying to find a place to hide :D .
I have always found that developers were the biggest problem when it came to secuirty issues. They always knew what they were doing much better than any domain admin. Afterall if you really knew what you were doing you would be programming.

lol, That might explain my Norton is always asking me to reinstall it. The problem is I don't have the installation CD (it was preinstalled on my computer).

Quote:

---

Heh heh heh, now if you are like me.....you would consider Norton to be Malware and not be surprised at all that it was picked up.

I really don't like Nortons or how hard it is to completely remove from a computer after it has been installed on it.

---

Yup, I 100% agree with you on this.
I think microsoft shouldn't get into the antispyware business and leave it for the proper companies instead.

Well coltm4carbine

I don't think that you are watching Microsoft carefully enough.

Quote:

---

I think microsoft shouldn't get into the antispyware business and leave it for the proper companies instead.

---

This is a magazine review (PC World, I think):

Quote:

---

The package is simply a branded version of Giant Company Software's AntiSpyware program, which has been on the market for some time. Microsoft purchased Giant last year. The 6.4MB program works with Windows 2000, Windows XP, and Windows Server 2003.

---

Microsoft have bought into the AV and antispyware industry. Not just bought the name or the business, they have bought the expertise and a working product.

I believe that they have finally accepted that producing belated patches for their operating systems is not enough, and that they need to be a bit more proactive in their approach.

However, that does not mean that I would trust them entirely, so I would always use other products as well. We know that MS has business relationships with some rather unsavoury (IMO) outfits, and that their antispyware doesn't handle cookies, for example.

:)