Kaspersky Update Breaks Internet Access For Windows XP Users

An anonymous reader writes "Yesterday afternoon, Kaspersky Labs released a definition update that blocked all Internet and Intranet access on Windows XP workstations. While there has been no official communication from Kaspersky, their forum is lit up with angry customers relying on each other to find a fix." Update: 02/05 16:42 GMT by T : Thanks to an anonymous reader, who says that Kaspersky has issued a statement, and a fix (though the fix takes some manual labor to implement).

Comments

let me guess

[Anonymous Coward]

they already have a fix you can download!

Link to fix

[davidwr]

http://forum.kaspersky.com/index.php?showtopic=255508&st=20&p=1978848&#entry1978848

Text of fix, credit the forum poster known as "omaudio":

from Kaspersky-

"We apologize for the inconvenience. It does appear that there was a hiccup with an Update pushed out causing Windows XP machines to lose internet connectivity. An update was just released that should address the issue, what I will need you to do is:

To get XP users internet connectivity (temporarily), please disable the Web AV component of your protection policy for your managed computers. After doing so;

In Security Center (or Admin Kit):

1.) Go to the Repositories section >> (Right click) Updates >> All Tasks >> Clear updates repository.
2.) Go to the Repositories section >> (Right click) Updates >> Download Updates

After taking this step, please run your group Update task for Managed Computers. After the update has been pushed to your workstations, please re-enable your Web AV component in your protection policy. This should resolve the issue. "

When does AV become more risky than the virus?

[Alioth]

I have to wonder at which point workstation AV software becomes a bigger risk than the actual malware.

So far in our organization, we've had two AV incidents. One several years ago when a user brought in an infected laptop with one of the Microsoft RPC exploiting worms. We got the worm before the AV vendor (Symantec at the time) had a signature for it, so the AV software was totally useless. The other event was when Symantec erroneously flagged a Windows Server 2003 resource kit program as malware and quarantined it (fortunately, a program we didn't rely on). So so far, for us - AV has failed to catch our only malware infection and has broken a non-infected program. Strict filtering (both inbound AND outbound) has done a lot more to stop malware in our organization than AV software ever has.

I also remember an incident a few years ago when a prominent AV vendor's software (I think it was Norton) erroneously quarantined a system file in the Chinese version of WinXP, and rendered the workstation unbootable, affecting a very large number of users.

I also wonder if any of the AV companies have independently verified and verifiable procedures for making their updates; a malicious employee at one of the big AV vendors could cause a lot of damage by releasing an update that results in an important system file getting quarantined. What safeguards do each AV vendor have in place to prevent this happening? How is it verified that the companies are actually carrying out the policies if they have them to ensure updates are not malicious, and how is it verified that these policies are actually watertight?

"There has been no official communication..."

[hobarrera]

there has been no official communication from Kaspersky

It seems they were using Windows XP.

Re:It's not just with WinXP.

[WhatAreYouDoingHere]

I had to physically remove its folder from the Program Files area...

I just got this mental picture of someone opening up their hard drive and scraping a section off one of the platters.... :)