Slashdot Mirror
Rootkit-like Feature Found in Norton Systemworks
GenieGenieGenie writes "eWeek reports a rootkit-like 'feature' in Symantec's Norton Systemworks, discovered by the Mark Russinovich, who was also responsible for blowing the whistle on Sony's DRM rootkit. The cloaked directory is intended to prevent users from accidentally deleting important files, but could compromise a system by serving as a hiding place for malware, as was the case with Sony's rootkit. Russinovich says Symantec had good intentions, but they were right to post an update to fix this hole."
I have always been suspect of Symantec.
I am sure the DHS knows what it is doing when it gives Symantec money to "secure" linux.
Gawd help us.
The truth about Led Zep should never be told on
This is not the Sony rootkit. It's just a directory that's not scanned by antivirus/antispyware.
And, now that it's potential vulnerability has been exposed, Symantec is releasing a new version without the protected recycle bin.
In other words, too bad they had to have their wrists slapped to fix it, but there was no malicious attempt.
Obligatory Soundbite Catchphrase
That's still a problem in Linux.
Obligatory Soundbite Catchphrase
I've never much liked Norton Antivirus, and this just adds more fuel to the fire.
"...Symantec's update further protects computers by displaying the directory,"
That's great! Our product is now better, because we turned off something bad we were previously doing!
Now that's a nice spin!
Steps of action when joe six-pack brings me a windoz box: 1. Uninstall Norton 2. Install AVG 3. Delete all "e"'s from everywhere 4. Install Firefox 5. Install Opera 6. Delete all Outlook shortcuts 7. Install Thunderbird 8. Install VLC and associate all media with it 9. Teach the guy to right-click/scan with AVG everything he downloads from the internet It worked nice in most occasions My 2p
www.lemonodor.com A mostly Lisp weblog
Their target for SystemWorks is not Slashdot posting people like you and there are people who actually DELETE these files making their system unusable.
System admins use Symantec corparate solutions which has NOTHING TO DO with the stuff mentioned here.
But keep bashing Symantec. It is number 2 favorite target of geeks after real networks.
I bought it as a gift to a pure newbie computer user who is really busy with stuff rather than dll and registry hunting manually, he is happy to this day.
A "cloaked" system folder that can be made visible in Folder Options is different from a directory created by a rootkit-like piece of software. By definition, a rootkit patches the OS it's compromised so that the operating system itself cannot see the directories. It sounds to me like Symantec's actions here are very similar to what Sony BMG got in all that hot water for.
Odd thing is, it was pretty widely known that some anti-virus programs have rootkit-like properties; i.e. they hide directories from the OS. Ostensibly, this is to prevent malware from accessing the directories and compromising the anti-virus. Not saying it's right, just saying this shouldn't be a big shock.
Never underestimate the power of stupid people in large groups.
"They're really complicated!" is no excuse for not following the conventional uninstall procedure and requiring that a separate uninstall program be downloaded separately from the internet.
Although you are an anonymous troll I think you are somewhat right:
The actual real (for the end user) problem I see for Windows, that other OSS do not have is that you require to install certain "security" software after installing the O.S. The software is among others:
- Antivirus (Like McAffee or Norton or AVG or Sophos)
- System security programs: Kind of like Norton System works or SANDRA or Diskkeeper
- Another browser (like firefox or opera)
The bad thing about that is not the number of software programs you have installed but the number of programs that must stay RESIDENT on RAM from the beginning.
That slows PC a lot, and it is something that (at least in my experience) you do not need to do when using Linux.
As an example, my current machine has the Sweepsrv.sys (Sophos AV) with 25,796 private Bytes. Then I have Firefox with 141,188 Bytes and on my laptop I have AVG free version and perfectdisk monitor.
Sure, I know how to disable all those things but that is one of me most common problems why people have to reinstall windows after several months.
On Linux you dont need a running antivirus so that memory (and processing time) can be used for something better. Oh, and it is also annoying that if you are Moving large files, you have to wait after selecting and pressing CTRL+X to cut it and CTRL+V to paste it on another side because the antivirus is checking the file.
Ubuntu is an African word meaning 'I can't configure Debian'
I know they have that now, but they didn't at the time.
Worse, I don't trust Symantec to really remove their software. Why doesn't uninstall remove the software? Why do I need to uninstall then run "really uninstall" to really uninstall it?
You were mistaken. Which is odd, since memory shouldn't be a problem for you
I don't know if there is a relationship or not, but when the company was known as Norton (for Peter Norton), they had good products. When they transitioned to Symantec they seemed to make whatever they touched worse.
Norton's utilities were great, tiny, fast little tools that did what you wanted in a predictable way. A must have in the DOS days, and even early Window days. As Symantec the tools seemed to get more and more bloated. Then some of the tools had to be bought separately, costing more money. They took over PC Anywhere at some point, and made the tool so large that it was all but impossible to load into some DOS based systems (with plenty of RAM) and still be able to run the rest of the system properly. They took over WinFax and took out some of the best features and seemed to make it more prone to failures.
It's a pattern of theirs. And a great disappointment. And why I, also, no longer buy or use anything from them. First thing I do on new equipment that has their software is uninstall it. Same thing I tell others.
. 62,400 repetitions make one truth -- Brave New World, Aldous Huxley