Antivirus Webroot Deletes Windows Files, Causes Serious Problems For Users (pcworld.com)

Users of Webroot's endpoint security product, consumers and businesses alike, had a nasty surprise Monday when the program started flagging Windows files as malicious. From a report: The reports quickly popped up on Twitter and continued on the Webroot community forum -- 14 pages and counting. The company came up with a manual fix to address the issue, but many users still had problems recovering their affected systems. The problem is what's known in the antivirus industry as a "false positive" -- a case where a clean file is flagged as malicious and is blocked or deleted. False positive incidents can range in impact from merely annoying -- for example, when a program cannot run anymore -- to crippling, where the OS itself is affected and no longer boots. The Webroot incident falls somewhere in the middle because it affected legitimate Windows files and sent them to quarantine. This is somewhat unusual because antivirus firms typically build whitelists of OS files specifically to prevent false positive detections.

Comments

Not exactly big news.

[richy freeway]

I'm sure all three users were massively upset though.

Is there a problem?

[Anonymous Coward]

> the program started flagging Windows files as malicious

I don't see the problem. Works well.

Re:Is there a problem?

[kurkosdr]

Translation: GOT THE JOKE??? I am an FSF neckbeard and consider Windows malicious for not conforming with my personal definition of non-malicious, and for that reason I think Webroot flagging Windows files as malicious is funny!!111 Joking aside, this incident proves WebRoot doesn't run automated tests before farting out a definition update, which every AV vendor should do.

Flags Windows as malicious

[rmdingler]

Something /. users have been doing for years.

Every Antivirus has done this.

[freeze128]

This has happened to every Antivirus. This is why Microsoft made their own - Microsoft Security Essentials, and also Windows Defender. In the era of Microsoft's own AV, there is no need for a third-party AV installed on Windows.

Re:Every Antivirus has done this.

[Anonymous Coward]

including microsoft's.

and, btw, microsoft did not "make their own".

they bought rav from gecad in '03, and giant antispyware in '04. those turned into onecare (later mse) and defender, respectively.

this is what they do: buy other companies or other companies technologies; and failing that, copy someone else's idea or product or poach their employees to recreate them.

Re:Every Antivirus has done this.

[dcooper_db9]

In the era of Microsoft's own AV, there is no need for a third-party AV installed on Windows.

Not according to Microsoft. They say that Defender is intended as a fallback to provide some level of protection when no other antivirus is installed. It is not intended to provide full anti-malware protection.

Well On The Bright Side

[Greyfox]

After it can't boot anymore, Windows is WAY more secure than it was. Really, you could say they're doing a GREAT job of keeping your system free of virusses!

Another day in the Windows world

[OneHundredAndTen]

Windows users are probably used to this kind of nonsense by now.

Reasons for not Microsoft

[DrYak]

In the era of Microsoft's own AV, there is no need for a third-party AV installed on Windows.

Nope, quite the contrary : There IS need for third-parties too.

The more diverse the antivirus landscape is, the more AV virus-writer needs to test their creations against.
Avoid monoculture !
It's harder when a Virus needs to go unnoticed by all of Microsoft AV, Kaspersky AV, Avira, F-Prot, Clam, etc. rather than only the first one on the list.

Re:Reasons for not Microsoft

[michaelwigle]

Yup, that's why I install all of them at once! No virus is gonna get me (because my system won't boot)... :P

P.S. I agree. Diverse 3rd party products do help make the bad guys job harder.