Slashdot Mirror
Symantec Updates Cause Chaos in China
Hello Kitty writes "According to Computerworld, a signature update to Symantec's anti-virus software has knocked out thousands of Chinese PCs. Apparently the latest update for the AV component of the various Norton packages mistook two system files in the Chinese edition of Windows XP SP2 for the 'Backdoor.Haxdoor' trojan. Piracy issues may complicate recovery, since once the updates are installed Symantec says the only hope for reviving an affected system is to re-copy the affected DLLs from the Windows restore disks. Everyone has their official restore disks handy, right?"
I've got no sympathy for the Chinese. God only knows how many of the copies of Symantec Anti-virus over there are legitimately owned. This ought to teach them a good anti-piracy lesson.
Although it seems easy to accuse Symantec of receiving bribes form Microsoft to try to make piracy in China more difficult, this is unlikely to be the case. Never attribute to malice that which can be adequately explained by stupidity.
I'll probably be modded down for this...
Bwaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaahaha !
HA-HA!!!
Microsoft to Symantec: "Its OK, its not like there are many pirated versions, remember we have Windows Genuine Advantage!"
--sig fault--
Be careful about wishing ill on other people. Your desire to force them to purchase American products might inadvertently end up forcing them to use Linux instead, and then not only will American lose sales form China, but other countries might follow suit. Things are just fine the way they are now, so just try to find some way to be happy about it.
I'll probably be modded down for this...
...until some jackass posts a link to the files netapi32.dll and lsasrv.dll under the guise of a fix for these systems, but he has ACTUALLY infected with the backdoor.haxdoor virus?
Not a false positive. The Chinese pirated copies of windows probably come pre-installed with Backdoor.Haxdoor
And this is why everybody hates Norton.
This is no longer trojan but a full symbiant in china. If you kill the virus you kill the host.
Some drink at the fountain of knowledge. Others just gargle.
I guess this thread is going to become full of posts in the spirit of "they got what they deserved", as if this was an anti-piracy measure. Of course, piracy of IP is only legitimate when commited within USA, otherwise it is "OMG commies are stealig our moneyz". This was an effing software bug, which casued trouble to everyone, legitimate users too, and I don't see how piracy talk could be relevant. As a side note, having recovery CD's does not have to do anything with piracy. If you pirate Windows, you have all the CD's you need.
Who cares, fuck the Chinese market. They deserve to have thousands of their pirated computers go down. They are stealing money from the US everyday. It's bad enough we let them suck our manufacturing market dry simply for the sake of 30% off goods, now we are supposed to feel sorry for them that their pirated version of windows got hacked.. awwww.
Shit it probably IS a backdoor virus slipstreamed right into the Xp Sp2 install.
"CISRT said. "This issue has made a huge effection to Chinese people." I knew Symantec was effectionate because it wanted to screw my computer all the time. It's hard to decide what's worse - an infection or an "effection".
that the virus signature got lost in translation.
...Microsoft reports that they have quietly invested a 100 million dollars into Symantec and insists that it is purely a coincidence. Cough... :)
Okay, I understand when people say that patches cannot be tested against EVERY software package out there.
But to not test against the core files of the operating system you KNOW they will be installed upon?
And people pay an annual subscription fee for that kind of "service".
China is quick to legislate change. I believe after this, all of their social organizations will adopt Linux for the sake of national security.
It's hard to say if it creates more problems to viruses or to its users.
I just yesterday had to fight with a customer PC which was slowed down like molasses by this crap and had to use the registry trick to remove it because they have lost the uninstall password. I always recommend people to run better AV software (Avast, Avira, Clamwin, etc.) and I have yet to meet one that regretted to have thrown away the NAV/SAV junk.
The fine folks at Symantec should keep doing their research on viruses, but leave the software production to better developers.
...ought to be Symantec's new slogan.
Buying a Symantec product to protect your Windows PC is like hiring a quadriplegic to be your bodyguard.
China is said to have a great deal of piracy? Could they actually have been pirated copies with malicious code?
Sounds to me like it's time for a change. The Chinese have already demonstrated that when something from Western corporations runs amok they are quite willing to force a change on their people. I'm not saying it's right, it's just so.
Now, this problem has actually highlighted a bigger problem; that Windows is Western software controlled by Western interests. Even the ancillary software you need to run Windows effectively (read: anti-virus) is from third parties in the West who obviously wouldn't necessarily have the desires of the Chinese government in mind. Now, at best I can see the Chinese government is going to realize that their reliance on Western anti-virus solutions may be a flawed dependency and they will write their own Chinese-specific AV solution. At worst... this might just highlight to the Chinese government how vulnerable they are to a "cyber attack", either malicious or accidental that could potentially cripple them.
Microsoft might want to start "spinning", and quick. Chinese people are well aware there are better solutions out there than Windows for an operating system. It's only a matter of time before someone in power starts talking about "Red Flag Linux" and how it's openness can help prevent problems exactly like this... then it's all over for Microsoft in that market.
Yes, I realize the pirated Windows market is huge in China as well... but it's still a massive market for Microsoft to lose because of the accidental actions of one of their "trusted third parties".
I have my official restore copy right here!
For years I always installed Symantec products, and before them Central Point and Norton products.
They worked, they worked well, and I could see how they helped me.
Somewhere along the line though they became first large, then irritating, then expensive to keep updated (pay for virus signature updates?), then finally began actually damaging systems.
And somewhere along the line I stopped buying their products, installing their products, and recommending their products.
I've come to view Microsoft the same way. Between excessive DRM, excessive hardware demands, and a generally customer hostile attitude I find it hard to think that I would ever move to a Vista machine. Thus far Windows 2000 still does everything that I need with a lot less hassle.
Someday though I will need to upgrade. The question is what will fill the gap? Linux still isn't there, nor are most Open Source replacements for common Microsoft and Adobe applications.
Is there a company that can step in with a viable replacement for Photoshop or MS Office? Can OpenOffice or GIMP make the final leap to become a reasonable and reliable alternative to those tools? I don't want something that sort of does everything that Photoshop does, I want a professional tool that does everything, and does it equally well.
The door is open, we're just waiting someone to step through.
Three Squirrels
just another reason symantech is one product that immediately gets deleted from my computer.
We came,we saw, we kicked it's ass!
As a Linux and OS X user who only runs Monkeysoft in virtualization, I can only squeeze out a little amount pity for the affected folks.
EEEERRRRK. URGGGGGGGG. Hah! There it is.
1) Monkeysoft Windows is a weak OS that requires anti-virus software to keep it safe. The OS tells you as much itself.
2) Security starts with good design. Any OS that depends on third-party tools to be safe is not designed for networking. And THAT is Monkeysoft's real problem. The Internet has done more damage to their products than any competition.
3) The computing model in which anti-virus software companies manage users' safety remotely is a bad idea. Do they know what they are doing, and do you want them doing it? Probably not, and probably not.
Rich And Stupid is not so bad as Working For Rich And Stupid.
And so has Microsoft updates....
neither of which had anything to do with piracy issues, but rather doing things to my at work system that broke and even removed other legal software. Adobe is guilty of this too.
What this really means? Well for symantec to effect pirated systems would mean that symantec software was also pirated (which just happens to run on Windows system). Because this is a symantec problem more then it is a windows problem..... I'd imagine users of symantec will better question the risk of using risk prevention software. And Pirates are less likely to use it, leaving the effected to be less pirates and more honest users.
Since most pirated installations don't have the install media either, it's a sure fired way to wipe out thousands of fake installs in one fell swoop.
Undoubtedly, the vast majority (if not all) of the machines affected were either
(1) zombies bombarding our machines with annoying brute force attacks and/or
(2) illegitimate/illegal installs of Windows.
Its difficult to believe Symantec would actually go and do something so incredibly helpful and effective, afa computer security is concerned.
The Admin and the Engineer
In Soviet China, EVERYONE has "official restore" disks.
stuff |
At work we installed it on our CAD machines - and it totally killed the performance. We eventually switched to Panda, and have been really impressed. Saying that, Panda still has those bloody annoying popups telling the user it's doing something.
I wish the applications would just DO it, rather than constantly telling users about what they're abouts to do.
Fascinating. So you are floating the possibility that this was PLANNED? And what possible reason could Symantic have for annoying their customers this much?
The "pirates" will have every CD and diskette ever made readily available to them.
The only people who won't have the disks are the home users who have been spending their lives doing things other than storing and tracking everything that ever touched their computer.
But they've been PAYING for the regular updates to PROTECT them from "problems".
Not to mention that many OEM's don't provide the right disks. You get a "recovery" CD which will reformat your box and re-install all the software TO THE CONDITION YOU ORIGINALLY RECEIVED THE BOX.
Too bad about all your files and pictures and such.
Still waiting on the reasons why Symantec would do plan this and test it.
That would be funny. No mail in rebates in China.
What does any of this have to do with good design? If a program can be downloaded and run from the internet, it can be a virus. It's part of the risk of having a networked world. When you are using the most common OS, you will need some form of anti-virus software. If OS X or Linux were the most common OS, they would need anti-virus software as well. As long as people have the ability to run unsafe code (and yes that can be done on Linux and OS X), they can get viruses. This is Symantec being incredibly irresponsible. Failing to find something like this in pre-update testing (or the failure to test updates) is insane and they should be required to pay for repairs.
Yes. If they need help I'm sure that VMWare will be happy to provide them some expertise (seeing as how they seem to be sorely lacking it). And than is JUST FOR INSTALLING THE PATCH.
And you don't need to test "other intermediate patched up versions".
This is a virus scanner. Right?
So they only need to test against the various released versions of the files. All they need is a set of DIRECTORIES with the files to be scanned in them.
So one box could have ALL the various patches for that system. Based upon the variances in the files. One box for the US release. One box for the Spanish release. Etc.
And as I said, they don't have to be physical boxes. VMWare can help out a whole lot in that regard.
It's called "Computer SCIENCE" for a reason.
"The Chinese government has initiated steps for government agencies to surport Red Flag Linux, Chinese officals believe that if this goes smoothly then Red Flag Linux could be marketed internationally."
But for the sake of slashdot consistency this article needs a link to the fix for this problem, and I don't see it here yet.
Otherwise those poor folks in China might never get their computers working again.
Help stamp out iliturcy.
NOBODY has original install discs anymore. Go buy a PC and see if you get original install discs. You're screwed.
The best you can hope for now is that your machine allowed you to make a set of full system restore discs when you got it. Some of those will allow you to restore individual files, but many of these utilities just re-image your system drive, so you lose everything on there that was installed since the machine was new (at least, anything on the boot partition).
I'd say this is probably MORE destructive to people with legitimate copies, who probably just have such images. The pirates are more likely to have install CDs.
Look people they're just dumb. No company is intentionally going to want to shoot their foot off in China.
Could this be targeted at specific keys? This should be interesting as it unfolds.
Is this why dealextreme.com is down or something totally unrelated?
the pirated versions of windows I ran (win2k), I had full install disks.
the oem versions (win98, winxp, winxp) I bought at best buy and other places, my only option is to wipe everything and reinstall.
So, I would be screwed on the machines where I am a legitimate paying customer, and hunky dory on the machines where I was pirating.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
[dons tin-foil hat]
What if they weren't really false alarms, and there really is a back-door in those DLLs? Isn't it a little suspicious that only the Chinese version was affected? Obviously what happened is that someone convinced Microsoft to add a back door into the Chinese version, and then, since Symantec didn't test against the Chinese version of windows, it wasn't on Symantec's white list.
[removes tin-foil hat]
So what you are saying is that Symantec CORRECTLY identified those files as being infected.
Yet that does not seem to be what TFA stated. In fact, let's take a look at what, exactly, TFA stated, okay?
Well! It seems that your supposition was incorrect and that it was an actual flaw in Symantec's product that identified clean files as "infected".
Imagine that. It seems that Symantec did fuck up their update.
Yeah, why let the facts get in the way of disparaging an entire nation.
...for running symantec software.
Out of the frying pan and into the fire, it would seem.. http://en.wikipedia.org/wiki/Panda_Software
Is all this Symantec's fault for not protecting Monkeysoft better?
If you replace "common" with "most vulnerable", your statement makes sense. If a program can be downloaded and run from the internet, it can be a virus. Sure... and if it runs with root or root-like privileges, it can do serious damage. Guess which OS lets that happen? To protect yourself, you can install AV software and dedicate one (or both) of your dual CPU cores to constantly scanning every file that is accessed so you can be "safe". A fine value proposition for your computer investment. This is Symantec being incredibly irresponsible. Failing to find something like this in pre-update testing (or the failure to test updates) is insane and they should be required to pay for repairs. I agree that Symantec made a serious error in deploying an updated defence for the weak OS that they make money defending. But I bet they'll pay nothing, or at least as much to pirates as they do to licensed owners.
Rich And Stupid is not so bad as Working For Rich And Stupid.
You're ignoring the context in which his words were written. He didn't mean he has no sympathy for Chinese people in any circumstance; if you apply a little common sense it's clear that what he means is that he has no sympathy for the Chinese people pirating Windows who got hosed by this Symantec update. Of course he could have been more specific in his wording, but you are completely disregarding the context. If you take someone's words out of context you can make anyone look like an idiot. Context is everything.
Windows is a virus, but the proper name would not be Backdoor.Haxdoor... the files should have been detected as W32.Backdoor.MSoft.Windows, but it shouldn't have detected just two DLLs, the whole OS, the whole C:\WINNT and C:\WINDOWS directories. And the proper fix isn't to merely delete the files, the AV software needs to either patch the machine to turn it into a Mac and install OS X... or put Linux/any real OS on it.
Or has there been a distinct drop in spam since this happened? :)
I like the hands on approach of reading thought what the update is about, what it fixes and installing it at my own pace. I have done this with windows linux, and anything else I have used. Basically people are willing to abdicate control of their personal computers. Some are stupid and give control to anyone just to download a song, file-sharing software etc. Some give it to the companies they hope will protect them. I would say think of the problems we would have to put up with if those companies where not around. A lot of users are willing to install just about anything on their computers and if not for software warning them and restraining them albeit slightly we all would have a worse time of it. And so long as people install just anything (god help us) it does not matter what Operating system they are running.
...that which can be accounted for by stupidity.
Norton has been a really, really bad (and insecure) product for years. The fact that they force their product to integrate itself with the proper functioning of the OS itself is a great example of how badly their app is designed.
Ever since Norton and McAfee's whining screed about how they NEED the Vista source code in order to create their product, we see the true colors of how bad their products are. It's just another application, guys, get a grip. If you can't program properly, stop using "access to the source code" as an excuse for why your product is such complete and utter crap. Kaspersky AV never had access to Vista's source code, and they currently have the highest rated AV app.
That's why Norton's AV sucks. I have been advising people against that package for a while now. I have seen many machines loaded with Norton's, and ad-ware. Not to mention the whole package runs like 6 different applications in the background and is a resource hog. Trend Micro Internet Security is still top dog in my opinion. It is easy On the machine and catches damn near everything. But if your a cheapskate and want free, AVG or Avast(if you have a 64-bit processor).
First - how many viruses cause comparable damage _ever_?
Second - once I tried testing several known AVs with some fresh dialers and trojans I've had (mostly as email attachments). Not a single one(!) has been detected by AVG, Avast, and Kaspersky.
All they do is detecting irrelevant (in the age of Internet) old "viruses", wasting your resources, and through occasional fuckups like this one doing real damage. Good thing if your AV is at least free one.
This might be a joke, but it's very very probable that pirated Windows comes with all kinds of "bonus" software, like backdoors, viruses, rootkits, etc. It's just another way for the software pirates to get a little extra income, because other people will pirate their pirated copies (thus spreading their viruses even further.)
Read my post again. As I explained, any OS that allows you to run programs as root allows people to run programs that can damage their OS or files. Even if you run something as a standard user you still risk any files that your user account has available to it. Anti-virus isn't designed to protect the OS, its designed to protect people from themselves.
Again as long as users can execute unsafe code, you are guaranteed that some users will. People will download executable files and run them no matter the system and will damage the files that the user has access to. Windows has been moronic to allow everyone to have admin privileges but on Linux you can still mess up your own files, files that a lot of people consider very valuable. AV software can prevent people from running that type of software and losing those valuable files. I don't think anti-virus software is great by any means, I don't use it but if there were enough systems running Linux with average users, people would try to run the types of programs that anti-virus software blocks.
In the end, this story has nothing to do with any particular OS. We're talking about one company who are entrusted to protect their customers property from damage but end up making their customer's systems unusable. If you weren't so busy making your stupid "Monkeysoft" puns, you might realize that.
The recovery disk shipped with most systems will reset the computer to factory state, deleting all user files. Everybody here does have a recent backup, don't they? And you have all checked recently that it works?
Quidnam Latine loqui modo coepi?
UNIX is a common OS and it's been around for 37 years and networked for all that time.
I wouldn't make the claim that UNIX has been 'networked' for 37 years. The TCP/IP Stack didn't magically appear on that first PDP-7. Furthermore, for many of the early years of UNIX the 'network' was the computer, i.e. the people who 'networked' together were doing so because they were all logged onto the same timesharing UNIX system with dumb terminals. For years and years of historical UNIX usage, the 'network' was machines dialing each other up using UUCP in the wee hours of the morning to pass around big packets of email from one UNIX system to another.
Hope this helps you figure things out a bit better.
There is more reliable solution - AV software named AVAST. See my essentials http://inews.110mb.com/
The 10 computers in my office are all with Windows and Norton installed. All of the softwares were brought from an unknown CD vendor at a very reasonable price. At this moment everything seems still fine.
Except some of the computers have an annoying banner popping up from the bottom-right corner of screen states "You possibly are a victim of privated software". I wish Norton would have taken this banner a malware.
China, in fact, is very fragile.
But the funniest "bug" I've seen in an anti-virus software has come from F-Secure. An ancient version of their software had the uninstaller just delete everything from the folder it was installed in. A distant friend had installed it in c:/ and the uninstall had caused a huge havoc by the time the computer crashed!
I can see the headlines now: Microsoft violates HaxDoor patents!
Jeeepers how clever of DOD ta leave something extra in somebodies HongKong mailbox. Or wherever those chi-com hackers are hackhackhacking at gov'mnt kit. Listen up Kang! Coupla' Cisco_routers here_out ... coupla' Cisco_routers there_out ... pretty soon it adds up! Hate to have it happen from Mongolia to Vietnam. Eh hoser? I believe historically this is called a "shot across the bow"... or would be if the chi-coms had a real navy.
As for the conspiracy theories that surface in the comments: I guess that many people affected by the problem *do* have a genuine (god, how I hate that word) copy of Windows. If I'm not completely mistaken a valid license is required to receive new virus definitions. So why would anybody in their right mind "pirate" the operating system, which is crucial for many aspects of their daily work and for some people the only viable and/or only option known to exist, and then actually buy an overpriced virus scanner for which many better and cheaper or entirely free options exist - especially when it's highly unlikely that their copy of XP came with a 30 day trial version of Symantec products.
:/- spoon(_).
Really good words to describe many things happening on this planet: real copy.
Anti-virus software is a Monkeysoft-based market.
You say it's because Monkeysoft is popular. But you admit that Redmond has made a seriously bad design decision. If not for the Internet, Monkeysoft wouldn't have these costly episodes. You called its permissiveness "moronic", I didn't. But we agree there too.
Hmmm. Given that the OS was damaged in this case, it appears that the OS needs protection too. Bot networks and honeypots prove that this isn't just about userland files. Now in this case, the AV software itself harmed the OS. That SHOULD NOT be possible... but it ~has~ to be possible to give the AV software such access, because other applications have the same access too. Set aside the current news: there are many other examples of Monkeysoft OS being harmed or altered by malware and spyware. I worked in a corporate environment for several years and I know how easily the computer of even a careful Monkeysoft user can be compromised.
Given that AV software is a Monkeysoft market, and the fact that well over 98% of all virus reports are about Redmond, this is a nonsensical statement. But we'll agree to disagree.
Rich And Stupid is not so bad as Working For Rich And Stupid.
Connect two users by whatever protocol and you have a network. It doesn't have to be a "modern" one.
Rich And Stupid is not so bad as Working For Rich And Stupid.
After a Windows Update a couple of days ago, my PC went out. Hmm... a strange coincidence. Too bad I already formatted it and reinstalled from another WinXP disk my roommates happened to have lying around.... This information might've been handy then...
"MIT betrayed all of its basic principles."
WARNING: A virus has been detected on your computer. .... .... .... .... .... ....
Your computer has been infected with the Norton Anti-Virus Virus
There was an error removing this virus, please contact technical support
with your license key, windows recover disk, and proof of purchise.
System halted.
There was an error loading Windows XP, if this is the first time you have seen....
+++ATH0 NO CARRIER
Ha ha, ha ha, hahahahahaha
Next time get a Mac. Or maybe Red Flag Linux- this should give RFL a big boost.
From: thomson@symantec.com
To: gates@microsoft.com
CC: genuine-advantage@microsoft.com
Subject: Mission Accomplished
Hi Bill,
Done as requested. That will be one billion; pleasure doing business with you.
-John
Just more reason for people to move away from the Virus Magnet. Hello, Linux calling!!!!
Karma: Bad is the liberal way of saying this guy won't drink the kool aid here on slash dot. I wear my Karma with pride
First off, let me say I have no sympathy whatsoever for anyone who is unable to recover their PC after this snafu because they were running a pirated version of Windows. No sympathy whatsoever.
Now, for all of those who were running a legitimate version of Windows and a legitimate version of Norton who were affected by this problem (probably a small percentage of all systems actually affected..) it really does suck.. and there are two sources of fault, here:
1) MS. Aren't critical OS files supposed to be protected, such that they can't be unwillingly be deleted or modified? Maybe this is part of the reason why MS didn't want AV vendors to have kernel mode access to Vista..
2) Norton (duh). How they could manage to screw this up so badly boggles the mind.
I am the maverick of Slashdot
Yeah, cuz those run like well-oiled machines, assuming the machines in question are McCormick rapers. (does the work of a hundred men!)
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
...they can get the Symantec guys.
Of course, it can be harder to convince a Linux user to download and run a program directly off the web, since distros have package managers. But I've downloaded and compiled several programs in the past year, and I haven't looked through the thousands of lines of source of any of them (a casual look won't do it, you'll need to go over them with a fine-toothed comb and a static analysis tool). Sure... and if it runs with root or root-like privileges, it can do serious damage. Guess which OS lets that happen? For almost any purposes, it doesn't matter if the malware gets root. Consider a Linux desktop: if a malicious program gets access to your account, it can steal your files, keylog you (it can get root that way if you ever su or sudo), or install a modded Firefox or extension which sends your bank account info to the attacker. It can send mail, it can attack other machines, it can listen on the network, it can make itself autolaunch via cron or login scripts.
Sure, it can't affect other users, but on most desktop machines, there's only one user anyway. It can't listen on low ports or sniff or spoof packets. It can't install a rootkit, but it can hide itself from the user it's installed on (it can change environment variables to cause your programs to link with a hacked libc, and it can alias the statically linked ones). These things are a big deal on servers, but on desktops they aren't.
I hereby place the above post in the public domain.
How was the software to know? All those Chinese files look alike.
Strangely enough, F-Secure also ran into a false positive on a Windows system file (shdocvw.dll) on the same day, and on the Simplified and Traditional Chinese editions of Windows...
A sudden (but temporary) decrease in:
viruses.
Trojans.
Worms.
warez.
spam.
Adware/Spyware.
Corporate espionage.
Copyright infringement.
Baby sales.
Human slaves.
Ebay sales.
Etc...
Don't kid yourselves, this is China my peepz.
Symantec did the world a favor.
And I put my money on it NOT being a fuck up on Symantecs part.
You actually think the majority of Chinese would pay for American software to begin with.
LOL LMAO LOL LMAO
This update also incorrectly identifies the Pegasus email client executable file as the Trojan.Dropper virus. An email to Semantic got nothing in return except instruction on how to remove a virus that I don't actually have.
Don't project negative moderation in the subject of your comment.
Help stamp out iliturcy.