Cloud & Telecom Security

This morning, Symantec’s worldwide customers found their computers failed to reboot, in the mean time the helpdesk was plunged into a hot pot. The rough root course is that Norton released wrong virus code definition by identifing a few system files(.exe and .dll) as virus and removing them. This will cause system reboot failure.

It’s a very severe incident from a global security perspective. One wrong operation might cause corruption of tens of millions of computer worldwide. In addition, security managers are put into a very embarrassed situation: whether or not you push users to install anti-virus software and keep virus code updated. It seems that both side will hurt you and the authority of security policy.

Till now, only Simplified Chinese version Windows XP SP2 system is reported to be impacted. Two system files under C:windowssystem32: netapi32.dll, and lsasrv.exe are identified wrongly as virus.

Users are prompted that these two files are infected by virus and need to be quarantined. If users follow the prompt, after reboot, the system corrupts…

At this moment, Symantec doesn’t release any news, notification, anslysis, solution, workaround on it officially.

[Tags]Security,Symantec,Anti-Virus[/Tags]