Slashdot Mirror


Antivirus Webroot Deletes Windows Files, Causes Serious Problems For Users (pcworld.com)

Users of Webroot's endpoint security product, consumers and businesses alike, had a nasty surprise Monday when the program started flagging Windows files as malicious. From a report: The reports quickly popped up on Twitter and continued on the Webroot community forum -- 14 pages and counting. The company came up with a manual fix to address the issue, but many users still had problems recovering their affected systems. The problem is what's known in the antivirus industry as a "false positive" -- a case where a clean file is flagged as malicious and is blocked or deleted. False positive incidents can range in impact from merely annoying -- for example, when a program cannot run anymore -- to crippling, where the OS itself is affected and no longer boots. The Webroot incident falls somewhere in the middle because it affected legitimate Windows files and sent them to quarantine. This is somewhat unusual because antivirus firms typically build whitelists of OS files specifically to prevent false positive detections.

1 of 67 comments (clear)

  1. Reasons for not Microsoft by DrYak · · Score: 3, Informative

    In the era of Microsoft's own AV, there is no need for a third-party AV installed on Windows.

    Nope, quite the contrary : There IS need for third-parties too.

    The more diverse the antivirus landscape is, the more AV virus-writer needs to test their creations against.
    Avoid monoculture !
    It's harder when a Virus needs to go unnoticed by all of Microsoft AV, Kaspersky AV, Avira, F-Prot, Clam, etc. rather than only the first one on the list.

    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]